CVE-2018-20682

Fork CMS XSS Vulnerability

5.4 Medium

CVE-2018-20682 is a medium vulnerability (CVSS 5.4) in Fork-cms Fork Cms, published January 9, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.56%, the 46th percentile. No source names a fixed version.

Fork CMS 5.0.6 allows stored XSS via the private/en/settings facebook_admin_ids parameter (aka "Admin ids" input in the Facebook section).

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: Required

What an attacker can affect

Confidentiality: Low
Integrity: Low
Availability: None

Exploit likelihood

0.56%Up 0.1 points since Apr 14, 2021

What each source reports

NVD Score used 5.4

Fork CMS 5.0.6 allows stored XSS via the private/en/settings facebook_admin_ids parameter (aka "Admin ids" input in the Facebook section).

Record: CVE-2018-20682
CVSS 3.0: 5.4 MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVSS 2.0: 3.5 LowAV:N/AC:M/Au:S/C:N/I:P/A:N
Weakness: CWE-79
Updated: 2026-11-02

CVE List No score

Fork CMS 5.0.6 allows stored XSS via the private/en/settings facebook_admin_ids parameter (aka "Admin ids" input in the Facebook section).

Record: CVE-2018-20682
Updated: 2026-11-02

EUVDEUVD-2022-5767 No score

Fork CMS 5.0.6 allows stored XSS via the private/en/settings facebook_admin_ids parameter (aka "Admin ids" input in the Facebook section).

Record: EUVD-2022-5767
Updated: 2026-11-03

GitHub AdvisoriesGHSA-xcmj-xjhg-wvhq 5.4

Fork CMS XSS Vulnerability

Fork CMS 5.0.6 allows stored XSS via the private/en/settings facebook_admin_ids parameter (aka "Admin ids" input in the Facebook section).

Record: GHSA-xcmj-xjhg-wvhq
CVSS 3.0: 5.4 MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weakness: CWE-79
Updated: 2026-11-02

OSV 5.4

Fork CMS 5.0.6 allows stored XSS via the private/en/settings facebook_admin_ids parameter (aka "Admin ids" input in the Facebook section).

Record: CVE-2018-20682
CVSS 3.0: 5.4 MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Updated: 2026-11-02

OSVGHSA-xcmj-xjhg-wvhq 5.4

Fork CMS XSS Vulnerability

Fork CMS 5.0.6 allows stored XSS via the private/en/settings facebook_admin_ids parameter (aka "Admin ids" input in the Facebook section).

Record: GHSA-xcmj-xjhg-wvhq
CVSS 3.0: 5.4 MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weakness: CWE-79
Updated: 2026-11-02

Affected products

fork-cms fork cms

Affected packages

Affected packages
Package	Affected	Fixed
`forkcms/forkcms` Packagist	through 5.0.6	None known
`forkcms/forkcms` Packagist	through 5.0.6, plus listed versions 3.5.03.5.13.6.03.6.13.6.2 Show 45 moreShow less 3.6.33.6.43.6.53.6.63.73.7.13.7.23.7.33.8.03.8.13.8.23.8.33.8.43.8.53.8.63.8.73.9.03.9.13.9.23.9.33.9.43.9.53.9.64.0.04.0.14.0.24.0.34.0.44.0.54.0.64.1.04.1.14.1.24.2.04.2.14.2.24.2.34.2.44.3.04.3.14.4.04.4.14.5.04.5.14.5.2	None known

History

History
When	Changed	Sources
2026-11-03	aliases	EUVD
2026-11-02	created	CVE List, GitHub Advisories, NVD, OSV

References

This page doesn't list everything

Left out here: 9 versions. The JSON record has them.