CVE-2019-9978: WordPress Social Warfare Plugin Cross-Site Scripting (XSS) Vulnerability
CVE-2019-9978 · Severity: critical · CVSS 6.1 · Exploited in the wild · Published 2021-11-03
The Social Warfare and Social Warfare Pro plugins for WordPress are vulnerable to stored Cross-Site Scripting (XSS) via the swp_url parameter in wp-admin/admin-post.php?swp_debug=load_options. This vulnerability can be leveraged to achieve remote code execution and was exploited in the wild as a zero-day.
Yes. CVE-2019-9978 is known to be exploited in the wild, first recorded on 3 November 2021. Treat it as urgent.
How severe is CVE-2019-9978?
Critical severity, with a CVSS score of 6.1, published 3 November 2021.
Which products and versions are affected?
Social Warfare Social Warfare before 3.5.3; Social Warfare Social Warfare Pro before 3.5.3.
Is there a fix for CVE-2019-9978?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2019-9978 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2019-9978?
Check whether you run Wordpress Social Warfare Plugin. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Affected products
Social Warfare Social Warfare before 3.5.3
Social Warfare Social Warfare Pro before 3.5.3
Timeline
2019-03-21: disclosed: Zero-day vulnerability reported and exploited in the wild.
2019-03-21: exploited: Exploitation in the wild observed in March 2019.
2021-11-03: kev added: Added to CISA Known Exploited Vulnerabilities Catalog.