CVE-2019-9978

The social-warfare plugin before 3.5.3 for WordPress has stored XSS via the wp-admin/admin-post.php?swp_debug=load_options swp_url parameter, as...

Basic Information

CVE State: PUBLISHED
Reserved Date: March 24, 2019
Published Date: March 24, 2019
Last Updated: February 07, 2025
Vendor: n/a
Product: n/a
Description: The social-warfare plugin before 3.5.3 for WordPress has stored XSS via the wp-admin/admin-post.php?swp_debug=load_options swp_url parameter, as exploited in the wild in March 2019. This affects Social Warfare and Social Warfare Pro.

CVSS Scores

SSVC Information

Exploitation: active
Technical Impact: partial

Exploit Status

Exploited in the Wild: Yes (added 2021-11-03 00:00:00 UTC) Source
Proof of Concept Available: Yes (added 2024-09-20 11:25:45 UTC) Source

References

https://wpvulndb.com/vulnerabilities/9238 https://www.cybersecurity-help.cz/vdb/SB2019032105 https://blog.sucuri.net/2019/03/zero-day-stored-xss-in-social-warfare.html https://www.wordfence.com/blog/2019/03/unpatched-zero-day-vulnerability-in-social-warfare-plugin-exploited-in-the-wild/ https://www.pluginvulnerabilities.com/2019/03/21/full-disclosure-of-settings-change-persistent-cross-site-scripting-xss-vulnerability-in-social-warfare/ https://wordpress.org/plugins/social-warfare/#developers https://twitter.com/warfareplugins/status/1108852747099652099 https://www.exploit-db.com/exploits/46794/ http://packetstormsecurity.com/files/152722/Wordpress-Social-Warfare-Remote-Code-Execution.html http://packetstormsecurity.com/files/163680/WordPress-Social-Warfare-3.5.2-Remote-Code-Execution.html

Known Exploited Vulnerability Information

Source	Added Date
CISA	2021-11-03 00:00:00 UTC

Scanner Integrations

Scanner	URL	Date Detected
Nuclei	https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-9978.yaml	2025-04-26 00:00:00 UTC

Potential Proof of Concepts

Warning: These PoCs have not been tested and could contain malware. Use at your own risk.

echoosso/CVE-2019-9978

Type: github • Created: 2025-03-27 23:18:51 UTC • Stars: 1

A Remote Code Execution (RCE) vulnerability in the Social Warfare plugin for WordPress, affecting versions below 3.5.3.

MAHajian/CVE-2019-9978

Type: github • Created: 2024-09-20 11:25:45 UTC • Stars: 0

grimlockx/CVE-2019-9978

Type: github • Created: 2023-01-20 16:29:18 UTC • Stars: 3

Remote Code Execution in Social Warfare Plugin before 3.5.3 for Wordpress.

d3fudd/CVE-2019-9978_Exploit

Type: github • Created: 2022-11-15 01:22:38 UTC • Stars: 2

Social WarFare Plugin (<=3.5.2) Remote Code Execution

KTN1990/CVE-2019-9978

Type: github • Created: 2019-05-06 04:48:43 UTC • Stars: 6

Wordpress Social Warfare Remote Code Execution (AUTO UPLOAD SHELL)

hash3liZer/CVE-2019-9978

Type: github • Created: 2019-05-03 05:57:44 UTC • Stars: 19

CVE-2019-9978 - (PoC) RCE in Social WarFare Plugin (<=3.5.2)

mpgn/CVE-2019-9978

Type: github • Created: 2019-03-25 23:38:58 UTC • Stars: 8

CVE-2019-9978 - RCE on a Wordpress plugin: Social Warfare < 3.5.3