CVE-2019-9978
MediumActively exploited (CISA KEV)
Description
The social-warfare plugin before 3.5.3 for WordPress has stored XSS via the wp-admin/admin-post.php?swp_debug=load_options swp_url parameter, as exploited in the wild in March 2019. This affects Social Warfare and Social Warfare Pro.
SeverityMedium
CVSS6.1
Exploit probability—
Product
WordPress Social Warfare Plugin
PublishedMar 24, 2019
First seenMar 24, 2019
Added to KEVNov 3, 2021
Weakness typeCWE-79Cross-site scripting (XSS)
How to fix
CISA required action
Apply updates per vendor instructions.
CISA due date: May 3, 2022Update
- warfareplugins social_warfare3.5.3 or later
- warfareplugins social_warfare_pro3.5.3 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| warfareplugins social_warfare | v < 3.5.3 | 3.5.3 |
| warfareplugins social_warfare_pro | v < 3.5.3 | 3.5.3 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.