PT-2019-6211 · Social Warfare · Social Warfare+1

Published 2019-03-21 · Updated 2025-11-07 · CVE-2019-9978

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Social Warfare plugin versions prior to 3.5.3 Social Warfare Pro versions prior to 3.5.3

Description The issue is related to stored XSS via the swp url parameter in the wp-admin/admin-post.php?swp debug=load options endpoint. This has been exploited in the wild in March 2019. The vulnerability exists due to inadequate protection of the webpage structure, allowing a remote attacker to perform cross-site scripting attacks.

Recommendations For Social Warfare plugin versions prior to 3.5.3, update to version 3.5.3 or later. For Social Warfare Pro versions prior to 3.5.3, update to version 3.5.3 or later. As a temporary workaround, consider restricting access to the wp-admin/admin-post.php?swp debug=load options endpoint until a patch is applied. Avoid using the swp url parameter in the affected endpoint until the issue is resolved.

Exploit

Fix

RCE

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2022-02995

CVE-2019-9978

Affected Products

Social Warfare

Social Warfare Pro

References · 33

• 🔥 https://github.com/hash3liZer/CVE-2019-9978 · Exploit
• 🔥 https://github.com/KTN1990/CVE-2019-9978 · Exploit
• 🔥 https://github.com/mpgn/CVE-2019-9978 · Exploit
• 🔥 https://github.com/grimlockx/CVE-2019-9978 · Exploit
• 🔥 https://cybersecurity-help.cz/vdb/SB2019032105 · Exploit
• 🔥 https://pluginvulnerabilities.com/2019/03/21/full-disclosure-of-settings-change-persistent-cross-site-scripting-xss-vulnerability-in-social-warfare · Exploit
• 🔥 http://packetstormsecurity.com/files/152722/Wordpress-Social-Warfare-Remote-Code-Execution.html · Exploit
• 🔥 https://exploit-db.com/exploits/46794 · Exploit
• 🔥 https://github.com/echoosso/CVE-2019-9978 · Exploit
• 🔥 http://packetstormsecurity.com/files/163680/WordPress-Social-Warfare-3.5.2-Remote-Code-Execution.html · Exploit
• 🔥 https://blog.sucuri.net/2019/03/zero-day-stored-xss-in-social-warfare.html · Exploit
• https://bdu.fstec.ru/vul/2022-02995 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2019-9978 · Security Note
• https://osv.dev/vulnerability/CVE-2019-9978 · Vendor Advisory
• https://twitter.com/babe_eliza24/status/1741500995245625501 · Twitter Post