CVE-2019-9978
WordPress Social Warfare Plugin Cross-Site Scripting (XSS) Vulnerability
Description
CVE-2019-9978 is a stored cross-site scripting (XSS) vulnerability in the WordPress Social Warfare plugin before version 3.5.3 that can be leveraged for remote code execution. The vulnerability exists in the swp_url parameter of the wp-admin/admin-post.php?swp_debug=load_options endpoint, allowing unauthenticated attackers to inject malicious scripts that are persistently stored and executed in the context of other users’ browsers. This CVE-2019-9978 vulnerability was exploited as a zero-day in the wild in March 2019, affecting both Social Warfare and Social Warfare Pro. With a CVSS score of 6.1 (MEDIUM) and an EPSS score of 88.13% (99.5th percentile), this XSS vulnerability poses a significant risk to WordPress sites using the affected plugin.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| warfareplugins | social warfare | < 3.5.3 |
| warfareplugins | social warfare pro | < 3.5.3 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
References
- http://packetstormsecurity.com/files/152722/Wordpress-Social-Warfare-Remote-Code-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/163680/WordPress-Social-Warfare-3.5.2-Remote-Code-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- https://blog.sucuri.net/2019/03/zero-day-stored-xss-in-social-warfare.html(Exploit, Third Party Advisory)
- https://twitter.com/warfareplugins/status/1108852747099652099(Third Party Advisory)
- https://wordpress.org/plugins/social-warfare/#developers(Product)
- https://wpvulndb.com/vulnerabilities/9238(Broken Link, Third Party Advisory)
- https://www.cybersecurity-help.cz/vdb/SB2019032105(Exploit, Third Party Advisory)
- https://www.exploit-db.com/exploits/46794/(Third Party Advisory, VDB Entry)
- https://www.pluginvulnerabilities.com/2019/03/21/full-disclosure-of-settings-change-persistent-cross-site-scripting-xss-vulnerability-in-social-warfare/(Exploit, Third Party Advisory)
- https://www.wordfence.com/blog/2019/03/unpatched-zero-day-vulnerability-in-social-warfare-plugin-exploited-in-the-wild/(Third Party Advisory)
- http://seclists.org/fulldisclosure/2025/Jun/1(Mailing List)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-9978(US Government Resource)
Weakness Type
CWE-79: Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’)
The WordPress Social Warfare plugin fails to properly neutralize user-supplied input in the swp_url parameter before incorporating it into plugin settings, resulting in stored cross-site scripting. Attackers can inject JavaScript code that persists in the plugin’s configuration and executes in the browsers of administrators and site visitors, enabling session hijacking, credential theft, and ultimately remote code execution through the WordPress admin interface.
Learn more: CWE-79 — Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’)
Impact Analysis
CVE-2019-9978 carries a CVSS 3.1 score of 6.1 (MEDIUM), though the real-world impact extends significantly beyond what this score suggests due to the potential for remote code execution through the XSS chain. The vulnerability is remotely exploitable over the network with low attack complexity and requires no authentication, though it does require user interaction (a victim must view a page containing the injected script). The scope is changed, meaning the XSS payload executes in the victim’s browser context, affecting resources beyond the vulnerable WordPress component. Confidentiality (Low): session tokens and cookies can be stolen. Integrity (Low): page content can be modified and malicious actions performed on behalf of users. While the CVSS rates these impacts as low, the stored nature of this XSS combined with WordPress admin capabilities enables full remote code execution. The EPSS score of 88.13% (99.5th percentile) indicates an extremely high likelihood of exploitation, consistent with the confirmed zero-day exploitation in March 2019.
Exploit Maturity
CVE-2019-9978 has extensive public exploit availability and was exploited as a zero-day before any patch was available. Public exploit code is available via Packet Storm Security (RCE exploit) and a second RCE variant. CISA has confirmed active exploitation in the wild by including this vulnerability in the Known Exploited Vulnerabilities catalog. The EPSS score of 88.13% (99.5th percentile) indicates an extremely high probability of exploitation. The vulnerability was discovered being actively exploited as a zero-day in March 2019, with attackers using the stored XSS to inject malicious redirects and backdoors into WordPress sites before the vendor released a patch.
Remediation
- Apply updates immediately as mandated by CISA KEV: Update Social Warfare to version 3.5.3 or later, and Social Warfare Pro to version 3.5.3 or later.
- If immediate updating is not possible, deactivate and remove the Social Warfare plugin entirely until a patched version can be installed. The debug endpoint that enables exploitation should not be accessible.
- Audit WordPress sites for indicators of compromise: check for injected JavaScript in plugin settings, review site content for unauthorized redirects, search for unknown admin accounts, and inspect wp-content for web shells or backdoor files that may have been deployed through the XSS-to-RCE chain.
- Implement Content Security Policy (CSP) headers to restrict script execution sources, reducing the impact of any XSS vulnerabilities. Deploy a Web Application Firewall (WAF) with rules to detect and block XSS payloads in request parameters.
- Review all WordPress plugin settings for unauthorized modifications. Reset administrator session tokens and credentials, and enable two-factor authentication for all admin accounts to limit the impact of session hijacking through XSS.
Technical Details
CVE-2019-9978 is a stored cross-site scripting vulnerability (CWE-79) in the WordPress Social Warfare plugin’s debug functionality. The swp_debug=load_options parameter of wp-admin/admin-post.php accepts a swp_url value that is stored in the plugin’s settings without proper sanitization or output encoding. When the plugin renders these settings on pages, the injected script executes in the context of any user’s browser viewing the page, including administrators. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) indicates the attack requires no authentication but needs user interaction (visiting the compromised page), and the scope change reflects that the injected scripts execute in a different security context than the vulnerable server-side component. The escalation from XSS to full remote code execution is possible because WordPress administrators can edit PHP files through the theme editor or install plugins containing arbitrary code.
Frequently Asked Questions
Is CVE-2019-9978 being actively exploited?
Yes. CVE-2019-9978 was exploited as a zero-day in March 2019 before any patch was available, and CISA has confirmed active exploitation by listing it in the Known Exploited Vulnerabilities catalog. The EPSS score of 88.13% (99.5th percentile) indicates an extremely high probability of ongoing exploitation.
What products are affected by CVE-2019-9978?
CVE-2019-9978 affects the WordPress Social Warfare plugin in all versions before 3.5.3 and Social Warfare Pro in all versions before 3.5.3. Both the free and premium versions of the plugin are vulnerable to this stored XSS vulnerability.
How do I fix CVE-2019-9978?
Update Social Warfare and Social Warfare Pro to version 3.5.3 or later. If updating is not immediately possible, deactivate and remove the plugin. After patching, audit the site for indicators of compromise including injected scripts, unauthorized admin accounts, and backdoor files. See the Remediation section for detailed steps.
How severe is CVE-2019-9978?
CVE-2019-9978 has a CVSS 3.1 score of 6.1 (MEDIUM), but the real-world severity is higher due to the ability to escalate from stored XSS to remote code execution in WordPress. With an EPSS score in the 99.5th percentile and confirmed zero-day exploitation, this vulnerability demands immediate remediation.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.