Vulnerability · Published May 10, 2026 · Assigned by VulnCheck

CVE-2021-47927WordPress Plugin WP Symposium Pro 2021.10 Stored XSS via wps_admin_forum_add_name

Medium 6.4

In plain English

A medium-severity cross-site scripting in WP Symposium Pro from Wpsymposiumpro. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 9% of all known vulnerabilities).

Severity (CVSS 3.1)6.4Medium

Exploit odds (30 days)0.2%top 90.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

WordPress Plugin WP Symposium Pro 2021.10 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by exploiting insufficient sanitization of the forum name parameter. Attackers can submit POST requests to the admin setup page with JavaScript payloads in the wps_admin_forum_add_name parameter, which are stored and executed when the forum is accessed.

Affected products (as reported)

Vendor	Product	Versions
Wpsymposiumpro	WP Symposium Pro	2021.10

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

References

ExploitDB-50514 exploit
Official Product Homepage product
Product Reference product
VulnCheck Advisory: WordPress Plugin WP Symposium Pro 2021.10 Stored XSS via wps_admin_forum_add_name third-party-advisory