Description
The social-warfare plugin before 3.5.3 for WordPress has stored XSS via the wp-admin/admin-post.php?swp_debug=load_options swp_url parameter, as exploited in the wild in March 2019. This affects Social Warfare and Social Warfare Pro.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
n/a n/a
n/aaffected
References
- https://wpvulndb.com/vulnerabilities/9238 ↗
- https://www.cybersecurity-help.cz/vdb/SB2019032105 ↗
- https://blog.sucuri.net/2019/03/zero-day-stored-xss-in-social-warfare.html ↗
- https://www.wordfence.com/blog/2019/03/unpatched-zero-day-vulnerability-in-social-warfare-plugin-exploited-in-the-wild/ ↗
- https://www.pluginvulnerabilities.com/2019/03/21/full-disclosure-of-settings-change-persistent-cross-site-scripting-xss-vulnerability-in-social-warfare/ ↗
- https://wordpress.org/plugins/social-warfare/#developers ↗
- https://twitter.com/warfareplugins/status/1108852747099652099 ↗
- https://www.exploit-db.com/exploits/46794/ ↗
- http://packetstormsecurity.com/files/152722/Wordpress-Social-Warfare-Remote-Code-Execution.html ↗
- http://packetstormsecurity.com/files/163680/WordPress-Social-Warfare-3.5.2-Remote-Code-Execution.html ↗
- http://seclists.org/fulldisclosure/2025/Jun/1 ↗
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-9978 ↗