CVE-2018-20986

MEDIUM 5.4CVE-2018-20986 · Published 22/08/2019 · updated 17/06/2026

In short

CVE-2018-20986 is a MEDIUM (CVSS 5.4) vulnerability affecting advanced custom fields (advancedcustomfields).
Chance of exploitation in the next 30 days (EPSS): 0.95%, higher than 61.2% of all vulnerabilities.
Fix: update to 5.7.8 or later.

Package	Affected versions	Patched versions
advanced custom fields advancedcustomfields	`< 5.7.8`	`5.7.8`

The advanced-custom-fields (aka Elliot Condon Advanced Custom Fields) plugin before 5.7.8 for WordPress has XSS by authors.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Package

Affected versions

Patched versions

< 5.7.8

5.7.8

More vulnerabilities in advanced custom fields

See all →