The social-warfare plugin before 3.5.3 for WordPress has stored XSS via the wp-admin/admin-post.php?swp_debug=load_options swp_url parameter
Social Warfare plugin versions 3.5.1 and 3.5.2 are affected, and the fix is version 3.5.3. CVSS rates it Medium.
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Actively exploited
- Fix
- Fixed in 3.5.3
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
Social Warfare and Social Warfare Pro, WordPress plugins for social sharing, contain a flaw that lets an attacker store malicious scripts on a affected site. Those scripts can then run in the browsers of people who view the affected pages or admin screens, which can be used to take actions as those users or steal their data.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
The social-warfare plugin before 3.5.3 for WordPress has stored XSS via the wp-admin/admin-post.php?swp_debug=load_options swp_url parameter, as exploited in the wild in March 2019. This affects Social Warfare and Social Warfare Pro.
Timeline
- CVE published
- Added to CISA KEV
CISA has evidence of exploitation in the wild
- CISA remediation deadline
Due date for US federal agencies to patch
- Record last updated
- EPSS reached 10%
FIRST estimates at least a 10% chance of exploitation in the next 30 days
Affected versions
- n/a n/a
Version range not reported
References 10
wpvulndb.com
cybersecurity-help.cz
blog.sucuri.net
wordfence.com
pluginvulnerabilities.com
wordpress.org
twitter.com
Exploit-DB
Questions about CVE-2019-9978
What does this mean?
The plugin's debugging code stores arbitrary JavaScript in the site database through a crafted request. That script then runs in the browser of every website visitor.Source: cybersecurity-help.cz, blog.sucuri.net
Am I affected, and how do I check?
Social Warfare versions 3.5.1 and 3.5.2 are listed as affected, and the CVE description also names Social Warfare Pro. The vulnerable path is the swp_debug=load_options request to /wp-admin/admin-post.php. The installed plugin version can be checked on the WordPress Plugins screen.Source: cybersecurity-help.cz, blog.sucuri.net
What should I do about it?
The advisory says to update to Social Warfare 3.5.3 as soon as possible. Until the update is applied, the listed workaround is a virtual patch from Sucuri Firewall or equivalent technology.Source: cybersecurity-help.cz, blog.sucuri.net
Is it being exploited?
Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2021-11-03, which means it has evidence of attacks. No public exploit code is tracked.Source: cisa.gov, cve.now feed data