CVE-2019-9978: WordPress Social Warfare Plugin Cross-Site Scripting (XSS) Vulnerability
The social-warfare plugin before 3.5.3 for WordPress has stored XSS via the wp-admin/admin-post.php?swpdebug=loadoptions swpurl parameter, as exploited in the wild in March 2019. This affects Social Warfare and Social Warfare Pro.
Other sources
WordPress Social Warfare plugin contains a cross-site scripting (XSS) vulnerability that allows for remote code execution. This vulnerability affects Social Warfare and Social Warfare Pro.
— CISA
Affected Software
Event History
Frequently Asked Questions
What is CVE-2019-9978?
CVE-2019-9978 is a Cross-Site Scripting (XSS) vulnerability in the WordPress Social Warfare Plugin.
What is the severity of CVE-2019-9978?
CVE-2019-9978 has a severity level of medium.
How does CVE-2019-9978 affect the Social Warfare Plugin?
CVE-2019-9978 affects the social-warfare plugin before version 3.5.3 of WordPress, allowing for stored XSS via the wp-admin/admin-post.php?swp_debug=load_options swp_url parameter.
What is the impact of CVE-2019-9978?
CVE-2019-9978 allows an attacker to inject malicious scripts into a website, potentially leading to unauthorized actions.
How can I fix CVE-2019-9978?
To fix CVE-2019-9978, users should update to version 3.5.3 or later of the Social Warfare Plugin for WordPress.