CVE-2019-9978: WordPress Social Warfare plugin stored XSS via swp_url parameter

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityIt is a known exploited vulnerability in CISA KEV with very high EPSS, though the CVSS base score is only 6.1 and exploitation requires user interaction.

What it is

The Social Warfare plugin for WordPress before 3.5.3 contains a stored cross-site scripting flaw reachable through the wp-admin/admin-post.php?swp_debug=load_options endpoint via the swp_url parameter. Because the injected payload is stored, it can execute in the browsers of users who later view the affected page, and the record notes it was exploited in the wild in March 2019.

Impact

An attacker can run arbitrary script in the context of a victim's session, enabling session or credential theft and actions performed as the victim. The CVSS vector scope change (S:C) indicates impact can extend beyond the vulnerable component.

Attack surface

Reached over the network through the WordPress admin endpoint admin-post.php with the swp_debug=load_options and swp_url parameters. The CVSS vector requires user interaction (UI:R) and no privileges (PR:N), so a victim must be induced to trigger or view the stored payload.

Exploitation

CISA added this to the KEV catalog on 2021-11-03, and the description states it was exploited in the wild in March 2019. EPSS is very high (0.72946, 99.4th percentile), and multiple references are tagged Exploit.

What to do

• Update the Social Warfare plugin to 3.5.3 or later; this is the vendor fix for the flaw.
• If immediate patching is not possible, disable or remove the Social Warfare plugin until it can be updated.
• Restrict access to wp-admin and admin-post.php to trusted networks or authenticated administrators where feasible.
• Review and remove any stored malicious content injected through the swp_url parameter in plugin settings or options.

Detection

• Search web and WAF logs for requests to wp-admin/admin-post.php containing swp_debug=load_options and swp_url parameters.
• Inspect stored plugin options and settings for unexpected script or HTML content introduced via swp_url.
• Monitor for anomalous outbound requests or script execution originating from WordPress admin pages hosting the plugin.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.