CVE-2018-20986

Advanced Custom Fields versions prior to 5.7.8 contain a cross-site scripting vulnerability that allows authenticated authors to store unfiltered HTML content in custom field values, bypassing the intended restriction that only users with the unfiltered_html capability should be able to do so. An attacker with author-level access could exploit this flaw to inject malicious scripts into fields, potentially affecting site visitors or administrators who view the compromised content. The vulnerability was resolved in version 5.7.8 through implementation of proper input filtering mechanisms.

Based on public CVE data (MITRE/NVD).