CVE-2014-8809: Multiple cross-site scripting (XSS) vulnerabilities in the WP Symposium plugin before 14.11 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) text parameter in an

medium Affects wp-symposium (WordPress plugin). Feed 2026.10.29.1, updated 2026-10-28; published 2014-12-24; advisory modified 2026-06-17.

Multiple cross-site scripting (XSS) vulnerabilities in the WP Symposium plugin before 14.11 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) text parameter in an

Package: wp-symposium (WordPress plugin) WordPress
Affected versions: <=14.10
Fixed in: no fix recorded
Severity: medium CVSS 4.3
Exploitation: not on CISA KEV · EPSS 2% (76.6th percentile)
Published: 2014-12-24
Source: nvd

References

CWE-79

NVD record wp-symposium (WordPress plugin) advisories

Am I affected?

Find out in one command. phpwarden checks your WordPress install against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.

# one-time install
pip install phpwarden

# then
phpwarden wordpress /var/www/html

Or keep it checked automatically with the GitHub Action or a nightly cron; see WordPress docs.

Install docs How findings are ranked

Related advisories

CVE-2015-6522 high SQL injection vulnerability in the WP Symposium plugin before 15.8 for WordPress allows re same package: wp-symposium (WordPress plugin)
CVE-2014-10021 high Unrestricted file upload vulnerability in UploadHandler.php in the WP Symposium plugin 14. same package: wp-symposium (WordPress plugin)
CVE-2015-3325 high SQL injection vulnerability in forum.php in the WP Symposium plugin before 15.4 for WordPr same package: wp-symposium (WordPress plugin)
CVE-2014-8810 medium SQL injection vulnerability in ajax/mail_functions.php in the WP Symposium plugin before 1 same package: wp-symposium (WordPress plugin)
CVE-2015-9414 medium The wp-symposium plugin through 15.8.1 for WordPress has XSS via the wp-content/plugins/wp same package: wp-symposium (WordPress plugin)
CVE-2011-3841 medium Cross-site scripting (XSS) vulnerability in uploadify/get_profile_avatar.php in the WP Sym same package: wp-symposium (WordPress plugin)