CVE-2020-36172: 
WordPress vulnerability analysis and mitigation

The Advanced Custom Fields (ACF) plugin versions before 5.8.12 for WordPress contained a Cross-Site Scripting (XSS) vulnerability. The vulnerability was identified with CVE-2020-36172 and was discovered on June 10, 2020. The issue specifically involved improper escaping of strings in Select2 dropdowns, which could potentially lead to XSS attacks (NVD, WPScan).

The vulnerability received a CVSS v3.1 Base Score of 6.1 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. The issue was classified as CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-Site Scripting'). The vulnerability stemmed from the plugin's failure to properly escape input from Select2 dropdowns (NVD, WPScan).

The vulnerability could allow attackers to execute cross-site scripting attacks through the Select2 dropdowns. This could potentially lead to unauthorized access to sensitive information and compromise of user interactions with the affected WordPress sites (NVD).

The vulnerability requires user interaction to be exploited, as indicated by the CVSS metrics. No specific details about exploitation in the wild were found in the available sources (NVD).

The vulnerability was fixed in version 5.8.12 of the Advanced Custom Fields plugin. Users are advised to update to this version or later to mitigate the security risk (WPScan).