Read the docs
TI-2021-22540 Aliases CVE-2021-47927GHSA-rj36-m5c4-rgw9

WordPress Plugin WP Symposium Pro 2021.10 Stored XSS via wps_admin_forum_add_name

Priority MEDIUM 56CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Cross-site scripting
Confidentiality · integrity · availability
None · None · None
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

WordPress Plugin WP Symposium Pro 2021.10 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by exploiting insufficient sanitization of the forum name parameter. Attackers can submit POST requests to the admin setup page with JavaScript payloads in the wps_admin_forum_add_name parameter, which are stored and executed when the forum is accessed.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00193 9th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
WpsymposiumproWP Symposium Pro2021.10—No fix listedCNA
  • WP Symposium Pro VendorWpsymposiumpro Affected 2021.10 Fixed in — No fix listed CNA

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-47927
  2. 2026-10-03 Alias added: GHSA-rj36-m5c4-rgw9

References

Exploit 1

Other 2

  • TI-2014-08183 Unrestricted file upload vulnerability in UploadHandler.php in the WP Symposium plugin… CVSS 2.0HIGH 7.5
  • TI-2014-07217 SQL injection vulnerability in ajax/mail_functions.php in the WP Symposium plugin before… CVSS 2.0MEDIUM 6.5
  • TI-2015-07791 The wp-symposium plugin through 15.8.1 for WordPress has XSS via the… CVSS 3.1MEDIUM 6.1
  • TI-2013-02355 Open redirect vulnerability in invite.php in the WP Symposium plugin 13.04 for WordPress… CVSS 2.0MEDIUM 5.8
  • TI-2011-03397 Cross-site scripting (XSS) vulnerability in uploadify/get_profile_avatar.php in the WP… CVSS 2.0MEDIUM 4.3
  • TI-2014-07216 Multiple cross-site scripting (XSS) vulnerabilities in the WP Symposium plugin before… CVSS 2.0MEDIUM 4.3
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences