Lucene search
K
Catalog
Vendors
Products
Timeline
Vulnerabilities
Sources
Documentation
Blog
Glossary
FAQ
Brand assets
Assessment
Agents dashboard
Agent Scanning
API Scanning
Assessment API
Alerts
Email notifications
Webhook notifications
Alerts API
SBOM package analysis
API Reference
Support
Settings
Sign in

CVE-2019-9978

🗓️ 24 Mar 2019 14:47:26Reported by mitreType 
cve
 cve🔗 web.nvd.nist.gov📰️ 3 Media mentions👁 1251 Views🌐 WEB

The social-warfare plugin for WordPress before 3.5.3 has stored XSS via the swp_url parameter

Related
Detection
Refs
Paths
Social
ReporterTitlePublishedViews
Family
0day.today		Wordpress Social Warfare Plugin 3.5.3 - Remote Code Execution Exploit
3 May 201900:00
–zdt
0day.today		WordPress Social Warfare 3.5.2 Remote Code Execution Exploit
27 Jul 202100:00
–zdt
GithubExploit		Vuln_Exploitation_MegaQuagga_Pentest
30 Apr 202600:52
–githubexploit
GithubExploit		Exploit for Cross-site Scripting in Warfareplugins Social_Warfare
3 May 201905:57
–githubexploit
GithubExploit		Exploit for Cross-site Scripting in Warfareplugins Social_Warfare
25 Mar 201923:38
–githubexploit
GithubExploit		Exploit for Cross-site Scripting in Warfareplugins Social_Warfare
1 Jan 202608:02
–githubexploit
GithubExploit		Exploit for Cross-site Scripting in Warfareplugins Social_Warfare
27 Mar 202523:18
–githubexploit
GithubExploit		Exploit for Cross-site Scripting in Warfareplugins Social_Warfare
25 Jan 202619:32
–githubexploit
GithubExploit		Exploit for Cross-site Scripting in Warfareplugins Social_Warfare
20 Jan 202316:29
–githubexploit
ATTACKERKB		CVE-2019-9978
24 Mar 201900:00
–attackerkb
Rows per page
NVD
Node
warfarepluginssocial_warfareRange<3.5.3wordpress
OR
warfarepluginssocial_warfare_proRange<3.5.3wordpress
SourceLink
packetstormsecuritywww.packetstormsecurity.com/files/152722/Wordpress-Social-Warfare-Remote-Code-Execution.html
wordpresswww.wordpress.org/plugins/social-warfare/
exploit-dbwww.exploit-db.com/exploits/46794/
cybersecurity-helpwww.cybersecurity-help.cz/vdb/SB2019032105
packetstormsecuritywww.packetstormsecurity.com/files/163680/WordPress-Social-Warfare-3.5.2-Remote-Code-Execution.html
blogwww.blog.sucuri.net/2019/03/zero-day-stored-xss-in-social-warfare.html
wordfencewww.wordfence.com/blog/2019/03/unpatched-zero-day-vulnerability-in-social-warfare-plugin-exploited-in-the-wild/
twitterwww.twitter.com/warfareplugins/status/1108852747099652099
pluginvulnerabilitieswww.pluginvulnerabilities.com/2019/03/21/full-disclosure-of-settings-change-persistent-cross-site-scripting-xss-vulnerability-in-social-warfare/
wpvulndbwww.wpvulndb.com/vulnerabilities/9238
Rows per page
ParameterPositionPathDescriptionCWE
swp_debugquery paramwp-admin/admin-post.php?swp_debug=load_optionsRCE via swp_url in Social Warfare plugin (CVE-2019-9978) where unsanitized input leads to remote code executionCWE-79
swp_urlquery paramwp-admin/admin-post.php?swp_debug=load_optionsRCE via swp_url in Social Warfare plugin (CVE-2019-9978) where unsanitized input leads to remote code executionCWE-79

Data

Build on a solid foundation with Vulners data

We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data

Api

Power your application with Vulners API

The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access

App

Assess and manage vulnerabilities with Vulners tools

Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation

Book a live demo
07 Nov 2025 19:33Current
6Medium risk
Vulners AI Score6
CVSS 24.3
CVSS 3.16.1
EPSS0.88711
SSVC
CWE-79In Wild
cve-2019-9978social-warfarewordpressxssnvdsecurity vulnerability
1251