CVE-2019-9978

Confirmed PUBLISHED

The social-warfare plugin before 3.5.3 for WordPress has stored XSS via the wp-admin/admin-post.php?swp_debug=load_options swp_url parameter, as...

Warfare Plugins · Social Warfare

Exploited in the wild PoC available

Recommended Action

Prioritize remediation. Validate affected assets and apply vendor fixes on an accelerated timeline.

View KEV Feed Talk to Sales

Confidence

Confirmed

Exploitation Status

Exploited in the wild

Observed in Sensors

Attempts (30d)

—

Unique Attacker IPs

—

CISA KEV

In CISA KEV

CVSS / EPSS

6.1 Medium EPSS 73.5%

At a Glance

The social-warfare plugin before 3.5.3 for WordPress has stored XSS via the wp-admin/admin-post.php?swp_debug=load_options swp_url parameter, as exploited in the wild in March 2019. This affects Social Warfare and Social Warfare Pro.

nuclei_scanner wordpress cisa php

CVE Published: Mar 24, 2019
Exploitation Reported: Nov 03, 2021
CVSS: 6.1 Medium
EPSS: 73.5%

Remote Low complexity Unauthenticated

Affected Versions

Vendor	Product	Version	Status
n/a	n/a	n/a	Affected

CVE References

46794 exploit-db.com · Exploit https://www.exploit-db.com/exploits/46794/
wpvulndb.com/vulnerabilities/9238 wpvulndb.com · CVE Record https://wpvulndb.com/vulnerabilities/9238
cybersecurity-help.cz/vdb/SB2019032105 cybersecurity-help.cz · CVE Record https://www.cybersecurity-help.cz/vdb/SB2019032105
blog.sucuri.net/2019/03/zero-day-stored-xss-in-social-warfar... blog.sucuri.net · CVE Record https://blog.sucuri.net/2019/03/zero-day-stored-xss-in-social-warfare...
wordfence.com/blog/2019/03/unpatched-zero-day-vulnerabilit... wordfence.com · CVE Record https://www.wordfence.com/blog/2019/03/unpatched-zero-day-vulnerabili...

Show 5 more references

pluginvulnerabilities.com/2019/03/21/full-disclosure-of-settings-chang... pluginvulnerabilities.com · CVE Record https://www.pluginvulnerabilities.com/2019/03/21/full-disclosure-of-s...
wordpress.org/plugins/social-warfare wordpress.org · CVE Record https://wordpress.org/plugins/social-warfare/#developers
twitter.com/warfareplugins/status/1108852747099652099 twitter.com · CVE Record https://twitter.com/warfareplugins/status/1108852747099652099
packetstormsecurity.com/files/152722/Wordpress-Social-Warfare-Remote... packetstormsecurity.com · CVE Record http://packetstormsecurity.com/files/152722/Wordpress-Social-Warfare-...
packetstormsecurity.com/files/163680/WordPress-Social-Warfare-3.5.2-... packetstormsecurity.com · CVE Record http://packetstormsecurity.com/files/163680/WordPress-Social-Warfare-...

Recommended Actions

Prioritize remediation. Validate affected assets and apply vendor fixes on an accelerated timeline.
Check enrichment artifacts for scanner coverage and available PoCs before rolling remediation validation.
Use the Pro API to automate enrichment, telemetry, and workflow delivery for VM, SOC, and CTI pipelines.

Known Exploited Vulnerability Sources

Catalogues that list this CVE as a known exploited vulnerability.

Per-source evidence links for KEV attestations are available through the KEVIntel Pro API.

Learn about Pro API access

Source	Added
CISA First	2021-11-03 00:00 UTC
The Shadowserver	2026-05-29 00:00 UTC
Tenable Blog	2026-07-20 13:36 UTC

Scanner Artifacts

Nuclei and Metasploit references linked to this CVE.

Scanner	Reference	Detected
Nuclei	https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-9978.yaml	Apr 25, 2025

CVSS Scores

CVSS v3.1 6.1 Medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CVSS v2.0 4.3 Medium

AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitation Status

Exploited in the wild

Recorded 2021-11-03 00:00:00 UTC · CISA

Proof of concept available

Recorded 2019-03-25 23:38:58 UTC · GitHub

Weaknesses (CWE)

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Scanner Integrations

Scanner	Reference	Detected
Nuclei	https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-9978.yaml	Apr 25, 2025

Recent Mentions

wp2shell (CVE-2026-63030, CVE-2026-60137): Frequently asked questions about remote code execution chain in WordPress Core

Tenable Blog · Jul 20, 2026

An unauthenticated attacker can chain two WordPress Core vulnerabilities, CVE-2026-63030 and CVE-2026-60137, to achieve remote code execution against affected WordPress installations. Multiple security firms have confirmed active in-the-wild exploitation within days of public disclosure, and public proof-of-concept exploits are circulating.Key takeaways:Two WordPress Core vulnerabilities, CVE-2026-63030 and CVE-2026-60137, can be chained together to achieve pre-authentication remote code execution against WordPress 6.9.x and 7.0.x installations. Multiple security firms have confirmed in-the-wild exploitation, with public proof-of-concept exploits appearing within hours of the July 17, 2026 disclosure. Patches are available in WordPress 7.0.2 and 6.9.5; WordPress.org has enabled forced automatic updates across affected supported installations. BackgroundTenable's Research Special Operations (RSO) team has compiled this blog to answer Frequently Asked Questions (FAQ) regarding wp2shell, two vulnerabilities in WordPress Core that can be chained together to achieve pre-authentication remote code execution.FAQWhat is wp2shell?wp2shell is the name given to two vulnerabilities in WordPress Core.When was wp2shell first disclosed?On July 17, 2026, WordPress released security updates addressing the wp2shell vulnerabilities alongside two GitHub Security Advisories. Adam Kues of Searchlight Cyber, who discovered and disclosed CVE-2026-63030, published research on the same day and chose to hold back the technical specifics given the severity of the finding. Searchlight Cyber also launched wp2shell.com, a testing tool that allows administrators to check whether their WordPress installation is vulnerable. On July 20, Searchlight Cyber published a full technical breakdown of the attack chain.What are the vulnerabilities associated with wp2shell?wp2shell is a two-vulnerability exploit chain affecting WordPress Core.CVEDescriptionCVSSv3CVE-2026-63030WordPress Core REST API...

Potential Proof of Concepts

These PoCs are unverified and could contain malware. Use at your own risk.

echoosso/CVE-2019-9978

github · Created 2025-03-27 23:18:51 UTC · 1 stars

A Remote Code Execution (RCE) vulnerability in the Social Warfare plugin for WordPress, affecting versions below 3.5.3.

MAHajian/CVE-2019-9978

github · Created 2024-09-20 11:25:45 UTC · 0 stars

grimlockx/CVE-2019-9978

github · Created 2023-01-20 16:29:18 UTC · 3 stars

Remote Code Execution in Social Warfare Plugin before 3.5.3 for Wordpress.

d3fudd/CVE-2019-9978_Exploit

github · Created 2022-11-15 01:22:38 UTC · 2 stars

Social WarFare Plugin (<=3.5.2) Remote Code Execution

KTN1990/CVE-2019-9978

github · Created 2019-05-06 04:48:43 UTC · 6 stars

Wordpress Social Warfare Remote Code Execution (AUTO UPLOAD SHELL)

hash3liZer/CVE-2019-9978

github · Created 2019-05-03 05:57:44 UTC · 19 stars

CVE-2019-9978 - (PoC) RCE in Social WarFare Plugin (<=3.5.2)

mpgn/CVE-2019-9978

github · Created 2019-03-25 23:38:58 UTC · 8 stars

CVE-2019-9978 - RCE on a Wordpress plugin: Social Warfare < 3.5.3

WordPress Social Warfare <3.5.3 - Cross-Site Scripting

nuclei · Created Unknown

Automate This Intelligence with the Pro API

Confidence scoring, exploit status, sensor telemetry, PoCs, scanner integrations, mentions, and tags are available programmatically for VM, SOC, and CTI workflows.

View Pro Pricing View API Docs

Pro API Example

GET /api/v2/pro/kevs/CVE-2019-9978

{
  "cve_id": "CVE-2019-9978",
  "title": "The social-warfare plugin before 3.5.3 for WordPress has stored XSS via the w...",
  "affected_vendor": "Warfare Plugins",
  "affected_product": "Social Warfare",
  "affected_versions": [
    { "vendor": "...", "product": "...", "status": "affected", "display_label": "..." }
  ],
  "confidence": "Confirmed",
  "cvss_score": 6.1,
  "epss_score": 0.73543,
  "exploit_status": {
    "exploited_in_the_wild": true,
    "active_exploitation_observed": false
  },
  "sensor_telemetry": { "...": "Pro API fields" },
  "proof_of_concepts": [ "..." ],
  "scanner_integrations": [ "..." ]
}

The free JSON API returns basic KEV fields only. Confidence, telemetry, and artifact enrichment require Pro API access.

CVE-2019-9978

At a Glance

Affected Versions

CVE References

Recommended Actions

Known Exploited Vulnerability Sources

Scanner Artifacts

Virtual Patch

CVSS Scores

Exploitation Status

Weaknesses (CWE)

Scanner Integrations

Recent Mentions

Potential Proof of Concepts

Timeline

Automate This Intelligence with the Pro API