CVE-2019-9978

Katalog CVE

CVSS 6.1 · Medium KEV · sudah dieksploitasi EPSS 72,9%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada warfareplugins social warfare, warfareplugins social warfare pro. Skor CVSS 3.1 6.1 (Medium) menurut NVD. Masuk katalog KEV CISA pada 3 November 2021, artinya sudah terbukti dieksploitasi.

Deskripsi (NVD)

The social-warfare plugin before 3.5.3 for WordPress has stored XSS via the wp-admin/admin-post.php?swp_debug=load_options swp_url parameter, as exploited in the wild in March 2019. This affects Social Warfare and Social Warfare Pro.

Rincian

Terbit di NVD

24 Maret 2019

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

6.1 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

EPSS (30 hari)

72,9% peluang dieksploitasi; lebih tinggi dari 99,4% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama

WordPress Social Warfare Plugin Cross-Site Scripting (XSS) Vulnerability

Masuk KEV

3 November 2021

Tenggat CISA

3 Mei 2022 (untuk instansi federal AS)

Ransomware

Belum tercatat

Tindakan wajib

Apply updates per vendor instructions.

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-9978 pemerintah AS
• http://packetstormsecurity.com/files/152722/Wordpress-Social-Warfare-Remote-Code-Execution.html exploit · advisory pihak ketiga · vdb entry
• http://packetstormsecurity.com/files/163680/WordPress-Social-Warfare-3.5.2-Remote-Code-Execution.html exploit · advisory pihak ketiga · vdb entry
• https://blog.sucuri.net/2019/03/zero-day-stored-xss-in-social-warfare.html exploit · advisory pihak ketiga
• https://twitter.com/warfareplugins/status/1108852747099652099 advisory pihak ketiga
• https://wpvulndb.com/vulnerabilities/9238 broken link · advisory pihak ketiga
• https://www.cybersecurity-help.cz/vdb/SB2019032105 exploit · advisory pihak ketiga
• https://www.exploit-db.com/exploits/46794/ advisory pihak ketiga · vdb entry
• https://www.pluginvulnerabilities.com/2019/03/21/full-disclosure-of-settings-change-persistent-cross-site-scri... exploit · advisory pihak ketiga
• https://www.wordfence.com/blog/2019/03/unpatched-zero-day-vulnerability-in-social-warfare-plugin-exploited-in-... advisory pihak ketiga
• https://wordpress.org/plugins/social-warfare/#developers product
• http://seclists.org/fulldisclosure/2025/Jun/1 mailing list