CVE-2019-9978
WordPress Social Warfare Plugin Cross-Site Scripting (XSS) Vulnerability
Published Mar 24, 2019 · updated Jun 16, 2026 · warfareplugins social warfare
The social-warfare plugin before 3.5.3 for WordPress has stored XSS via the wp-admin/admin-post.php?swp_debug=load_options swp_url parameter, as exploited in the wild in March 2019. This affects Social Warfare and Social Warfare Pro.
Timeline
Detection, updates, and resolution for this record.
Mar 24, 2019 · Catalog
Detected
The social-warfare plugin before 3.5.3 for WordPress has stored XSS via the wp-admin/admin-post.php?swp_debug=load_options swp_url parameter, as exploited in the wild in March 2019. This affects Social Warfare and Social Warfare Pro.
Nov 3, 2021 · CISA KEV
Known exploited
Apply updates per vendor instructions.
May 3, 2022 · CISA KEV
Remediation due
Apply updates per vendor instructions.
Jun 16, 2026 · Catalog
Updated
The social-warfare plugin before 3.5.3 for WordPress has stored XSS via the wp-admin/admin-post.php?swp_debug=load_options swp_url parameter, as exploited in the wild in March 2019. This affects Social Warfare and Social Warfare Pro.
Required action
Apply updates per vendor instructions.
CISA due date May 3, 2022
Affected
- cpe warfareplugins/social warfareversion unspecified
- cpe warfareplugins/social warfare proversion unspecified
- vendor WordPress Social Warfare Pluginversion unspecified
Sources
- CISA KEVCVE-2019-9978
WordPress Social Warfare plugin contains a cross-site scripting (XSS) vulnerability that allows for remote code execution. This vulnerability affects Social Warfare and Social Warfare Pro.
cisa.gov - CVE.orgCVE-2019-9978
Official CVE identifier
cve.org - FIRST EPSSCVE-2019-9978
30-day exploitation probability 72.9%
first.org - Exploit Database46794
Public archive entry. The exploit body is not stored here.
exploit-db.com - Exploit Database52346
Public archive entry. The exploit body is not stored here.
exploit-db.com - NIST NVDCVE-2019-9978
The social-warfare plugin before 3.5.3 for WordPress has stored XSS via the wp-admin/admin-post.php?swp_debug=load_options swp_url parameter, as exploited in the wild in March 2019. This affects Social Warfare and Social Warfare Pro.
nvd.nist.gov