blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2014-8809

MEDIUM 4.3 CVSS 2.0
Published
December 24, 2014
Last modified
June 17, 2026
NVD status
Modified
Reported by
cve@mitre.org
Weakness
CWE-79
CVSS vector
AV:N/AC:M/Au:N/C:N/I:P/A:N

Description

Multiple cross-site scripting (XSS) vulnerabilities in the WP Symposium plugin before 14.11 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) text parameter in an addComment action to ajax/profile_functions.php, (2) compose_text parameter in a sendMail action to ajax/mail_functions.php, (3) comment parameter in an add_comment action to ajax/lounge_functions.php, or (4) name parameter in a create_album action to ajax/gallery_functions.php.

Affected products and versions

  • n/a n/a — Versions not specified
  • wpsymposiumpro wp_symposium — Up to and including 14.10

References