CVE-2021-47927

MEDIUM 6.4

WordPress Plugin WP Symposium Pro 2021.10 Stored XSS via wps_admin_forum_add_name

CVSS Score

6.4

EPSS Score

0.0%

EPSS Percentile

0th

WordPress Plugin WP Symposium Pro 2021.10 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by exploiting insufficient sanitization of the forum name parameter. Attackers can submit POST requests to the admin setup page with JavaScript payloads in the wps_admin_forum_add_name parameter, which are stored and executed when the forum is accessed.

CWE	CWE-79
Vendor	wpsymposiumpro
Product	wp symposium pro
Published	May 10, 2026
Last Updated	May 11, 2026

Stay Ahead of the Next One

Get instant alerts for wpsymposiumpro wp symposium pro

Be the first to know when new medium vulnerabilities affecting wpsymposiumpro wp symposium pro are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

None

Integrity

None

Availability

None

Affected Versions

Wpsymposiumpro / WP Symposium Pro

2021.10

References

NVD ↗ CVE.org ↗ EPSS Data ↗

exploit-db.com: https://www.exploit-db.com/exploits/50514 wpsymposiumpro.com: http://www.wpsymposiumpro.com/ wordpress.org: https://wordpress.org/plugins/wp-symposium-pro/ vulncheck.com: https://www.vulncheck.com/advisories/wordpress-plugin-wp-symposium-pro-stored-xss-via-wps-admin-forum-add-name

Credits

Murat DEMIRCI (@butterflyhunt3r)