Threat Database

Threat Entry Updated 2026-06-17

Advanced Custom Fields - Cross-Site Scripting (XSS) (CVE-2021-24241)

The Advanced Custom Fields Pro WordPress plugin before 5.9.1 did not properly escape the generated update URL when outputting it in an attribute, leading to a reflected Cross-Site Scripting issue in the update settings page.

PLUGIN Advanced Custom Fields

CVE-2021-24241

MEDIUM CVSS 6.1 2021-04-22

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

Advanced Custom Fields - Cross-Site Scripting (XSS) (CVE-2020-36172)

The Advanced Custom Fields plugin before 5.8.12 for WordPress mishandles the escaping of strings in Select2 dropdowns, potentially leading to XSS.

PLUGIN Advanced Custom Fields

CVE-2020-36172

MEDIUM CVSS 6.1 2021-01-06

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

Advanced Custom Fields - Cross-Site Scripting (XSS) (CVE-2018-20986)

The advanced-custom-fields (aka Elliot Condon Advanced Custom Fields) plugin before 5.7.8 for WordPress has XSS by authors.

PLUGIN Advanced Custom Fields

CVE-2018-20986

MEDIUM CVSS 5.4 2019-08-22

Risk Score

Open Full Technical Breakdown