WordPress · Social Warfare Plugin
CVE-2019-9978
WordPress Social Warfare Plugin Cross-Site Scripting (XSS) Vulnerability
What it is
The social-warfare plugin before 3.5.3 for WordPress has stored XSS via the wp-admin/admin-post.php?swp_debug=load_options swp_url parameter, as exploited in the wild in March 2019. This affects Social Warfare and Social Warfare Pro.
CISA: WordPress Social Warfare plugin contains a cross-site scripting (XSS) vulnerability that allows for remote code execution. This vulnerability affects Social Warfare and Social Warfare Pro.
What to do
Apply updates per vendor instructions.
Deadline for US federal agencies: May 3, 2022
- Added to the CISA list
- November 3, 2021
- Published
- March 24, 2019
- Severity
- Medium 6.1 CVSS 3.1
- Chance of attacks in the next 30 days (EPSS)
- 73% in the top 0.6% of all known vulnerabilities
- Weakness
- CWE-79
- More details
- NVD · CVE.org · CISA
All references (10)
- https://wpvulndb.com/vulnerabilities/9238
- https://www.cybersecurity-help.cz/vdb/SB2019032105
- https://blog.sucuri.net/2019/03/zero-day-stored-xss-in-social-warfare.html
- https://www.wordfence.com/blog/2019/03/unpatched-zero-day-vulnerability-in-social-warfare-plugin-exploited-in…
- https://www.pluginvulnerabilities.com/2019/03/21/full-disclosure-of-settings-change-persistent-cross-site-scr…
- https://wordpress.org/plugins/social-warfare/#developers
- https://twitter.com/warfareplugins/status/1108852747099652099
- https://www.exploit-db.com/exploits/46794/
- http://packetstormsecurity.com/files/152722/Wordpress-Social-Warfare-Remote-Code-Execution.html
- http://packetstormsecurity.com/files/163680/WordPress-Social-Warfare-3.5.2-Remote-Code-Execution.html
More exploited flaws from WordPress
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Sep 25, 2026 | Remote File Inclusion | Core | High 8.1 | 96% |
| Jul 21, 2026 | SQL Injection | Core | Medium 5.9 | 5.3% |
| Jul 21, 2026 | Interpretation Conflict | Core | Critical 9.8 | 11% |
| Nov 3, 2021 | File Download | Snap Creek Duplicator Plugin | High 7.5 | 98% |
| Nov 3, 2021 | Remote Code Execution | File Manager Plugin | Critical 10.0 | 97% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.