CVE-2018-20682

Fork CMS 5.0.6 allows stored XSS via the private/en/settings facebookadminids parameter aka "Admin ids" input in the Facebook section...

Cross-Site Scripting (XSS)

forkcms/forkcms is vulnerable to cross-site scripting XSS. The facebookadminids parameter under the application's private settings is not validated and HTML encoded before being displayed on a user's browser, allowing a remote attacker to inject arbitrary Javascript into the victim's browser...