WP Symposium Pro 2021.10 contains a stored cross‑site scripting flaw that allows a logged‑in attacker to inject and persist JavaScript code by submitting a crafted value for the forum name on an admin setup page. Once stored, the malicious script runs whenever the forum is viewed, enabling actions such as session hijacking, cookie theft, or defacement. This weakness is classified as CWE‑79 and, based on the description, it is inferred that the flaw does not provide remote code execution capability.

The vendor is Wpsymposiumpro and the affected product is the WP Symposium Pro WordPress plugin, specifically version 2021.10. Users running that plugin installation on any WordPress site are potentially impacted.

The CVSS base score of 5.1 indicates moderate severity. EPSS data is not available and the vulnerability is not listed in CISA KEV. The attack requires authenticated access to the WordPress back‑end and POST submission to an admin configuration endpoint, meaning it is mainly exploitable by users with administrative privileges. While the threat is moderate, it can significantly compromise user session security and site integrity.