WordPress · Social Warfare Plugin
CVE-2019-9978
WordPress Social Warfare Plugin Cross-Site Scripting (XSS) Vulnerability
Nedir
The social-warfare plugin before 3.5.3 for WordPress has stored XSS via the wp-admin/admin-post.php?swp_debug=load_options swp_url parameter, as exploited in the wild in March 2019. This affects Social Warfare and Social Warfare Pro.
CISA: WordPress Social Warfare plugin contains a cross-site scripting (XSS) vulnerability that allows for remote code execution. This vulnerability affects Social Warfare and Social Warfare Pro.
Ne yapmalı
Apply updates per vendor instructions.
ABD federal kurumları için son tarih: 3 Mayıs 2022
- CISA listesine eklenme
- 3 Kasım 2021
- Yayımlanma
- 24 Mart 2019
- Önem
- Orta 6,1 CVSS 3.1
- Önümüzdeki 30 günde saldırı olasılığı (EPSS)
- 73% bilinen tüm açıkların en üstteki 0,6% diliminde
- Zayıflık
- CWE-79
- Daha fazla ayrıntı
- NVD · CVE.org · CISA
Tüm kaynaklar (10)
- https://wpvulndb.com/vulnerabilities/9238
- https://www.cybersecurity-help.cz/vdb/SB2019032105
- https://blog.sucuri.net/2019/03/zero-day-stored-xss-in-social-warfare.html
- https://www.wordfence.com/blog/2019/03/unpatched-zero-day-vulnerability-in-social-warfare-plugin-exploited-in…
- https://www.pluginvulnerabilities.com/2019/03/21/full-disclosure-of-settings-change-persistent-cross-site-scr…
- https://wordpress.org/plugins/social-warfare/#developers
- https://twitter.com/warfareplugins/status/1108852747099652099
- https://www.exploit-db.com/exploits/46794/
- http://packetstormsecurity.com/files/152722/Wordpress-Social-Warfare-Remote-Code-Execution.html
- http://packetstormsecurity.com/files/163680/WordPress-Social-Warfare-3.5.2-Remote-Code-Execution.html
WordPress için istismar edilen diğer açıklar
| Eklenme | Açık | Ürün | Önem | Saldırı olasılığı |
|---|---|---|---|---|
| 25 Eyl 2026 | Remote File Inclusion | Core | Yüksek 8,1 | 96% |
| 21 Tem 2026 | SQL Injection | Core | Orta 5,9 | 5,3% |
| 21 Tem 2026 | Interpretation Conflict | Core | Kritik 9,8 | 11% |
| 3 Kas 2021 | File Download | Snap Creek Duplicator Plugin | Yüksek 7,5 | 98% |
| 3 Kas 2021 | Remote Code Execution | File Manager Plugin | Kritik 10,0 | 97% |
Kaynaklar: Known Exploited Vulnerabilities (CISA, kamu malı), CVE records (cve.org) ve EPSS (FIRST). Saldırı olasılığı, birinin önümüzdeki 30 günde açığı istismar etmeye çalışacağına dair EPSS tahminidir.