CVE DATABASE / CVE-2019-9978
CVE-2019-9978
WordPress Social Warfare Plugin Cross-Site Scripting (XSS) Vulnerability
CVSS 6.1 · MEDIUM
⚠ CISA KEV — ACTIVELY EXPLOITED
On the CISA KEV catalog
Confirmed exploited in the wild. Added 2021-11-03.
Federal remediation due 2022-05-03.
Required action: Apply updates per vendor instructions.
Summary
The social-warfare plugin before 3.5.3 for WordPress has stored XSS via the wp-admin/admin-post.php?swp_debug=load_options swp_url parameter, as exploited in the wild in March 2019. This affects Social Warfare and Social Warfare Pro.
CVSS 3.1 breakdown
| Base score | 6.1 (MEDIUM) |
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
| Attack vector | NETWORK |
| Attack complexity | LOW |
| Privileges required | NONE |
| User interaction | REQUIRED |
| Scope | CHANGED |
| Confidentiality | LOW |
| Integrity | LOW |
| Availability | NONE |
Weakness type (CWE)
Affected products
Warfareplugins social warfareWarfareplugins social warfare pro
Check this CVE live
Use our free CVE Lookup tool for the latest NVD record, or browse the full CISA KEV catalog.
References
- http://packetstormsecurity.com/files/152722/Wordpress-Social-Warfare-Remote-Code-Execution.html
- http://packetstormsecurity.com/files/163680/WordPress-Social-Warfare-3.5.2-Remote-Code-Execution.html
- https://blog.sucuri.net/2019/03/zero-day-stored-xss-in-social-warfare.html
- https://twitter.com/warfareplugins/status/1108852747099652099
- https://wordpress.org/plugins/social-warfare/#developers
- https://wpvulndb.com/vulnerabilities/9238
- https://www.cybersecurity-help.cz/vdb/SB2019032105
- https://www.exploit-db.com/exploits/46794/
- https://www.pluginvulnerabilities.com/2019/03/21/full-disclosure-of-settings-change-persistent-cross-site-scripting-xss-vulnerability-in-social-warfare/
- https://www.wordfence.com/blog/2019/03/unpatched-zero-day-vulnerability-in-social-warfare-plugin-exploited-in-the-wild/
- http://seclists.org/fulldisclosure/2025/Jun/1
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-9978
Data: NIST NVD + CISA KEV. NVD last modified 2025-11-07. Always verify against the vendor advisory before acting.