Official Product Homepageproduct
http://www.wpsymposiumpro.com/ CVE-2021-47927
MEDIUM
WordPress Plugin WP Symposium Pro 2021.10 Stored XSS via wps_admin_forum_add_name
Record summary
CVE-2021-47927 has a selected CVSS score of 5.1 (medium); EIP currently links 1 catalogued exploit.
Description
WordPress Plugin WP Symposium Pro 2021.10 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by exploiting insufficient sanitization of the forum name parameter. Attackers can submit POST requests to the admin setup page with JavaScript payloads in the wps_admin_forum_add_name parameter, which are stored and executed when the forum is accessed.
Description source: CVE List
Exploitation context
Available material
- Catalogued exploits
- 1
CISA SSVC decision
ExploitationPoC
AutomatableNo
Technical impactPartial
CISA Coordinator · SSVC 2.0.3 · Evaluated May 11, 2026 · Source: CVE List
Affected products and versions
1| Product | Source | Version range | Status |
|---|---|---|---|
WP Symposium ProBrowse Wpsymposiumpro / WP Symposium Pro | CVE List | 2021.10 | affected |
Proofs of concept
1Catalogued exploits
ExploitDBWordPress Plugin WP Symposium Pro 2021.10 - 'wps_admin_forum_add_name' Stored Cross-Site Scripting (XSS)ExploitDB exploitby Murat DEMİRCİNot analyzed1 file
References
5nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2021-47927 Product Referenceproduct
https://wordpress.org/plugins/wp-symposium-pro ExploitDB-50514exploit
https://www.exploit-db.com/exploits/50514 VulnCheck Advisory: WordPress Plugin WP Symposium Pro 2021.10 Stored XSS via wps_admin_forum_add_nameThird-party advisory
https://www.vulncheck.com/advisories/wordpress-plugin-wp-symposium-pro-stored-xss-via-wps-admin-forum-add-name