CVE-2018-20682

Name of the Vulnerable Software and Affected Versions: Fork CMS version 5.0.6

Description: The issue allows stored XSS via the "Admin ids" input in the Facebook section, specifically through the facebook admin ids parameter in the private/en/settings endpoint.

Recommendations: For Fork CMS version 5.0.6, as a temporary workaround, consider restricting access to the private/en/settings endpoint until a patch is available. Avoid using the facebook admin ids parameter in this endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.