CVE-2020-36172

6.1 mediumEPSS 0.9%

Medium (6.1) in advancedcustomfields advanced custom fields. EPSS 0.9% chance of exploitation in the next 30 days.

The Advanced Custom Fields plugin before 5.8.12 for WordPress mishandles the escaping of strings in Select2 dropdowns, potentially leading to XSS.

Severity

6.1 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS: 0.9% chance of exploitation in the next 30 days; higher than 59% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2021-01-06
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19