CVE-2019-9978

WordPress Social Warfare Plugin Cross-Site Scripting (XSS)

6.1 MEDIUMActively exploited (CISA KEV)Public exploitEPSS 72.9%

Published24 Mar 2019
Added to CISA KEV3 Nov 2021
Remediation due3 May 2022

Description

The social-warfare plugin before 3.5.3 for WordPress has stored XSS via the wp-admin/admin-post.php?swp_debug=load_options swp_url parameter, as exploited in the wild in March 2019. This affects Social Warfare and Social Warfare Pro.

CVSS 3.1 breakdown

Attack vectorNetwork

Attack complexityLow

Privileges requiredNone

User interactionRequired

ScopeChanged

ConfidentialityLow

IntegrityLow

AvailabilityNone

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected products

Warfareplugins Social Warfare Pro< 3.5.3

Warfareplugins Social Warfare< 3.5.3

Remediation

Fixed in

Warfareplugins Social Warfare Pro≥ 3.5.3

Warfareplugins Social Warfare≥ 3.5.3

References

http://packetstormsecurity.com/files/152722/Wordpress-Social-Warfare-Remote-Code-Execution.htmlExploitThird Party AdvisoryVDB Entry
http://packetstormsecurity.com/files/163680/WordPress-Social-Warfare-3.5.2-Remote-Code-Execution.htmlExploitThird Party AdvisoryVDB Entry
https://blog.sucuri.net/2019/03/zero-day-stored-xss-in-social-warfare.htmlExploitThird Party Advisory
http://seclists.org/fulldisclosure/2025/Jun/1Mailing List
https://twitter.com/warfareplugins/status/1108852747099652099Third Party Advisory
https://wordpress.org/plugins/social-warfare/#developersProduct
https://wpvulndb.com/vulnerabilities/9238Broken LinkThird Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-9978US Government Resource
https://www.cybersecurity-help.cz/vdb/SB2019032105ExploitThird Party Advisory
https://www.exploit-db.com/exploits/46794/Third Party AdvisoryVDB Entry

and 2 more references

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

Frequently asked

Is CVE-2019-9978 being actively exploited?

Yes. CVE-2019-9978 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added 3 Nov 2021.

How severe is CVE-2019-9978?

CVE-2019-9978 has a CVSS 3.1 base score of 6.1, rated medium. EPSS estimates a 72.9% probability of exploitation.

Which products are affected by CVE-2019-9978?

Affected products include Warfareplugins Social Warfare Pro, Warfareplugins Social Warfare.

How do I fix CVE-2019-9978?

Upgrade affected software to a fixed version, for example Warfareplugins Social Warfare Pro 3.5.3, Warfareplugins Social Warfare 3.5.3 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2019-9978 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. Because it is on the CISA KEV list, Secuno flags any affected asset as top-priority automatically. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.