{"id":"CVE-2019-9978","aliases":["EUVD-2019-19332","GHSA-gfx2-wv94-38hv"],"status":"published","title":"The social-warfare plugin before 3.5.3 for WordPress has stored XSS via the wp-admin/admin-post...","description":"The social-warfare plugin before 3.5.3 for WordPress has stored XSS via the wp-admin/admin-post.php?swp_debug=load_options swp_url parameter, as exploited in the wild in March 2019. This affects Social Warfare and Social Warfare Pro.","severity":{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.72946,"percentile":0.99456,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":true,"fix_available":false},"cwes":["CWE-79"],"published":"2019-03-24T14:47:26Z","modified":"2026-10-24T10:30:52Z","kev":{"date_added":"2021-11-03","due_date":"2022-05-03","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Unknown"},"exploitation":[{"source":"euvd","since":"2021-11-03"},{"source":"kev","since":"2021-11-03"}],"exploits":[{"source":"pocgithub","id":"mpgn/CVE-2019-9978","title":"mpgn/CVE-2019-9978","date":"2019-03-25","url":"https://github.com/mpgn/CVE-2019-9978"},{"source":"exploitdb","id":"EDB-46794","title":"WordPress Plugin Social Warfare \u003c 3.5.3 - Remote Code Execution","type":"webapps","platform":"php","date":"2019-05-03","url":"https://www.exploit-db.com/exploits/46794"},{"source":"pocgithub","id":"hash3liZer/CVE-2019-9978","title":"hash3liZer/CVE-2019-9978","date":"2019-05-03","url":"https://github.com/hash3liZer/CVE-2019-9978"},{"source":"pocgithub","id":"KTN1990/CVE-2019-9978","title":"KTN1990/CVE-2019-9978","date":"2019-05-06","url":"https://github.com/KTN1990/CVE-2019-9978"},{"source":"pocgithub","id":"cved-sources/cve-2019-9978","title":"cved-sources/cve-2019-9978","date":"2019-05-06","url":"https://github.com/cved-sources/cve-2019-9978"},{"source":"pocgithub","id":"d3fudd/CVE-2019-9978_Exploit","title":"d3fudd/CVE-2019-9978_Exploit","date":"2022-11-15","url":"https://github.com/d3fudd/CVE-2019-9978_Exploit"},{"source":"pocgithub","id":"grimlockx/CVE-2019-9978","title":"grimlockx/CVE-2019-9978","date":"2023-01-20","url":"https://github.com/grimlockx/CVE-2019-9978"},{"source":"pocgithub","id":"h8handles/CVE-2019-9978-Python3","title":"h8handles/CVE-2019-9978-Python3","date":"2023-08-20","url":"https://github.com/h8handles/CVE-2019-9978-Python3"},{"source":"pocgithub","id":"0xMoonrise/cve-2019-9978","title":"0xMoonrise/cve-2019-9978","date":"2023-11-09","url":"https://github.com/0xMoonrise/cve-2019-9978"},{"source":"pocgithub","id":"MAHajian/CVE-2019-9978","title":"MAHajian/CVE-2019-9978","date":"2024-09-20","url":"https://github.com/MAHajian/CVE-2019-9978"},{"source":"pocgithub","id":"echoosso/CVE-2019-9978","title":"echoosso/CVE-2019-9978","date":"2025-03-27","url":"https://github.com/echoosso/CVE-2019-9978"},{"source":"pocgithub","id":"Housma/CVE-2019-9978-Social-Warfare-WordPress-Plugin-RCE","title":"Housma/CVE-2019-9978-Social-Warfare-WordPress-Plugin-RCE","date":"2025-05-19","url":"https://github.com/Housma/CVE-2019-9978-Social-Warfare-WordPress-Plugin-RCE"},{"source":"exploitdb","id":"EDB-52346","title":"Social Warfare WordPress Plugin 3.5.2 - Remote Code Execution (RCE)","type":"webapps","platform":"multiple","date":"2025-06-26","url":"https://www.exploit-db.com/exploits/52346"},{"source":"pocgithub","id":"Vaidehim55/CVE-2019-9978-RCE-PoC","title":"Vaidehim55/CVE-2019-9978-RCE-PoC","date":"2026-01-01","url":"https://github.com/Vaidehim55/CVE-2019-9978-RCE-PoC"},{"source":"pocgithub","id":"yup-Ivan/CVE-2019-9978","title":"yup-Ivan/CVE-2019-9978","date":"2026-01-25","url":"https://github.com/yup-Ivan/CVE-2019-9978"},{"source":"pocgithub","id":"aktia1/MegaQuagga_Pentesting_Report","title":"aktia1/MegaQuagga_Pentesting_Report","date":"2026-04-25","url":"https://github.com/aktia1/MegaQuagga_Pentesting_Report"},{"source":"pocgithub","id":"B4ntGrim/Vuln_Exploitation_MegaQuagga_Pentest","title":"B4ntGrim/Vuln_Exploitation_MegaQuagga_Pentest","date":"2026-04-30","url":"https://github.com/B4ntGrim/Vuln_Exploitation_MegaQuagga_Pentest"},{"source":"pocgithub","id":"B4ntGrim/Vuln_Remediation_MegaQuagga","title":"B4ntGrim/Vuln_Remediation_MegaQuagga","date":"2026-04-30","url":"https://github.com/B4ntGrim/Vuln_Remediation_MegaQuagga"},{"source":"pocgithub","id":"TokyoHunter/CVE-2019-9978-Social-Warfare-WordPress-RCE","title":"TokyoHunter/CVE-2019-9978-Social-Warfare-WordPress-RCE","date":"2026-07-07","url":"https://github.com/TokyoHunter/CVE-2019-9978-Social-Warfare-WordPress-RCE"},{"source":"nuclei","id":"CVE-2019-9978","title":"WordPress Social Warfare \u003c3.5.3 - Cross-Site Scripting","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-9978.yaml"}],"products":[{"vendor":"warfareplugins","product":"social_warfare"},{"vendor":"warfareplugins","product":"social_warfare_pro"},{"vendor":"wordpress","product":"social warfare plugin"}],"references":[{"url":"https://wpvulndb.com/vulnerabilities/9238","tags":["x_refsource_MISC","x_transferred","Broken Link","Third Party Advisory","advisory"]},{"url":"https://www.cybersecurity-help.cz/vdb/SB2019032105","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence"]},{"url":"https://blog.sucuri.net/2019/03/zero-day-stored-xss-in-social-warfare.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence"]},{"url":"https://www.wordfence.com/blog/2019/03/unpatched-zero-day-vulnerability-in-social-warfare-plugin-exploited-in-the-wild/","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory"]},{"url":"https://www.pluginvulnerabilities.com/2019/03/21/full-disclosure-of-settings-change-persistent-cross-site-scripting-xss-vulnerability-in-social-warfare/","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence"]},{"url":"https://wordpress.org/plugins/social-warfare/#developers","tags":["x_refsource_MISC","x_transferred","Product","web"]},{"url":"https://twitter.com/warfareplugins/status/1108852747099652099","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory"]},{"url":"https://www.exploit-db.com/exploits/46794/","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"http://packetstormsecurity.com/files/152722/Wordpress-Social-Warfare-Remote-Code-Execution.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","VDB Entry","evidence"]},{"url":"http://packetstormsecurity.com/files/163680/WordPress-Social-Warfare-3.5.2-Remote-Code-Execution.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","VDB Entry","evidence"]},{"url":"http://seclists.org/fulldisclosure/2025/Jun/1","tags":["Mailing List","article"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-9978","tags":["government-resource","US Government Resource","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-9978"},{"url":"https://www.exploit-db.com/exploits/46794"},{"url":"https://www.pluginvulnerabilities.com/2019/03/21/full-disclosure-of-settings-change-persistent-cross-site-scripting-xss-vulnerability-in-social-warfare"},{"url":"https://www.wordfence.com/blog/2019/03/unpatched-zero-day-vulnerability-in-social-warfare-plugin-exploited-in-the-wild"},{"url":"https://github.com/advisories/GHSA-gfx2-wv94-38hv"}],"sources":{"cve":[{"id":"CVE-2019-9978","description":"The social-warfare plugin before 3.5.3 for WordPress has stored XSS via the wp-admin/admin-post.php?swp_debug=load_options swp_url parameter, as exploited in the wild in March 2019. This affects Social Warfare and Social Warfare Pro.","status":"published","published":"2019-03-24T14:47:26Z","modified":"2025-10-21T23:45:41.75Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:20:20.081405Z"}],"euvd":[{"id":"EUVD-2019-19332","description":"The social-warfare plugin before 3.5.3 for WordPress has stored XSS via the wp-admin/admin-post.php?swp_debug=load_options swp_url parameter, as exploited in the wild in March 2019. This affects Social Warfare and Social Warfare Pro.","status":"published","published":"2019-03-24T14:47:26Z","modified":"2025-10-21T23:45:41Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"exploited_since":"2021-11-03","updated_at":"2026-11-02T20:31:24.172282Z"}],"ghsa":[{"id":"GHSA-gfx2-wv94-38hv","title":"The social-warfare plugin before 3.5.3 for WordPress has stored XSS via the wp-admin/admin-post...","description":"The social-warfare plugin before 3.5.3 for WordPress has stored XSS via the wp-admin/admin-post.php?swp_debug=load_options swp_url parameter, as exploited in the wild in March 2019. This affects Social Warfare and Social Warfare Pro.","status":"published","published":"2022-05-13T01:07:40Z","modified":"2025-10-22T00:32:42Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:04:06.493434Z"}],"kev":[{"id":"CVE-2019-9978","title":"WordPress Social Warfare Plugin Cross-Site Scripting (XSS) Vulnerability","description":"WordPress Social Warfare plugin contains a cross-site scripting (XSS) vulnerability that allows for remote code execution. This vulnerability affects Social Warfare and Social Warfare Pro.","cwes":["CWE-79"],"kev":{"date_added":"2021-11-03","due_date":"2022-05-03","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Unknown"},"updated_at":"2026-11-02T17:00:17.050017Z"}],"nvd":[{"id":"CVE-2019-9978","description":"The social-warfare plugin before 3.5.3 for WordPress has stored XSS via the wp-admin/admin-post.php?swp_debug=load_options swp_url parameter, as exploited in the wild in March 2019. This affects Social Warfare and Social Warfare Pro.","status":"published","published":"2019-03-24T15:29:00.243Z","modified":"2026-06-17T02:44:58.13Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:05:09.523883Z"}],"osv":[{"id":"CVE-2019-9978","description":"The social-warfare plugin before 3.5.3 for WordPress has stored XSS via the wp-admin/admin-post.php?swp_debug=load_options swp_url parameter, as exploited in the wild in March 2019. This affects Social Warfare and Social Warfare Pro.","status":"published","published":"2019-03-24T15:29:00.243Z","modified":"2026-10-24T10:30:52.702526136Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:13.492058Z"}]}}