Executive brief
WP Symposium Pro, a WordPress plugin used to create social networking and forum features, contains a security flaw that allows users with basic account access to inject malicious scripts. These scripts are permanently stored on the website and trigger whenever a user or administrator views the affected forum page. This could lead to unauthorized actions being performed in the context of other users, including administrators, potentially compromising the site's security or user data.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in WP Symposium Pro version 2021.10. The flaw is located in the 'wps_admin_forum_add_name' parameter of the admin setup page, which fails to sufficiently sanitize user-supplied input. An authenticated attacker can submit a crafted POST request containing a JavaScript payload. This payload is then stored in the database and executed in the browser of any user who accesses the forum. The plugin has been permanently closed on the WordPress repository as of September 2022, and users are advised to migrate to supported alternatives.
Affected products
- Wpsymposiumpro WP Symposium Pro 2021.10
Timeline
- 2021-11-12: disclosed: Exploit published on Exploit-DB
- 2022-09-11: other: Plugin permanently closed on WordPress.org at author's request
- 2026-05-10: advisory: CVE published/updated via VulnCheck