6.1Orta KEV

CVE-2019-9978WordPress Social Warfare Plugin Cross-Site Scripting (XSS) Vulnerability

warfareplugins social warfare; warfareplugins social warfare pro Yayım: 2019-03-24 17:47 (7 yıl önce)

Aktif olarak istismar ediliyor — WordPress Social Warfare Plugin Cross-Site Scripting (XSS) Vulnerability

CISA bu açığın gerçek saldırılarda kullanıldığını 03.11.2021 tarihinde doğruladı. ABD federal kurumları için düzeltme son tarihi: 03.05.2022.

Gerekli işlem: Apply updates per vendor instructions. https://nvd.nist.gov/vuln/detail/CVE-2019-9978

Açıklama

The social-warfare plugin before 3.5.3 for WordPress has stored XSS via the wp-admin/admin-post.php?swp_debug=load_options swp_url parameter, as exploited in the wild in March 2019. This affects Social Warfare and Social Warfare Pro.

Zayıflık türü (CWE): CWE-79

Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.

Etkilenen ürünler ve sürümler

Üretici	Ürün	Sürümler
warfareplugins	social warfare	< 3.5.3
warfareplugins	social warfare pro	< 3.5.3

Kaynaklar ve yamalar

https://wpvulndb.com/vulnerabilities/9238 Broken LinkThird Party Advisory
https://www.cybersecurity-help.cz/vdb/SB2019032105 ExploitThird Party Advisory
https://blog.sucuri.net/2019/03/zero-day-stored-xss-in-social-warfare.html ExploitThird Party Advisory
https://www.wordfence.com/blog/2019/03/unpatched-zero-day-vulnerability-in-social-warfare-plugin-exploited-in… Third Party Advisory
https://www.pluginvulnerabilities.com/2019/03/21/full-disclosure-of-settings-change-persistent-cross-site-scr… ExploitThird Party Advisory
https://wordpress.org/plugins/social-warfare/#developers Product
https://twitter.com/warfareplugins/status/1108852747099652099 Third Party Advisory
46794 exploitThird Party AdvisoryVDB Entry
http://packetstormsecurity.com/files/152722/Wordpress-Social-Warfare-Remote-Code-Execution.html ExploitThird Party AdvisoryVDB Entry
http://packetstormsecurity.com/files/163680/WordPress-Social-Warfare-3.5.2-Remote-Code-Execution.html ExploitThird Party AdvisoryVDB Entry
http://seclists.org/fulldisclosure/2025/Jun/1 Mailing List
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-9978 US Government Resource

CPE eşleşmeleri (NVD) (2)

cpe:2.3:a:warfareplugins:social_warfare:*:*:*:*:*:wordpress:*:* < 3.5.3
cpe:2.3:a:warfareplugins:social_warfare_pro:*:*:*:*:*:wordpress:*:* < 3.5.3

CVSS puanı

6.1Orta

Kaynak: CISA-ADP · CVSS 3.1

Saldırı yolu: Ağ
Karmaşıklık: Düşük
Gereken yetki: Yok
Kullanıcı etkileşimi: Gerekir
Kapsam: Değişir
Gizlilik: Düşük
Bütünlük: Düşük
Erişilebilirlik: Yok

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Tüm puanlar (4)

CISA-ADP	CVSS 3.1	6.1Orta
nvd	CVSS 3.1	6.1Orta
134c704f-9b21-4f2e-91b3-4a467353bcc0	CVSS 3.1	6.1Orta
nvd	CVSS 2.0	4.3Orta

EPSS (30 günde istismar olasılığı)

72.95%

tüm CVE'lerin %99'inden yüksek

CISA değerlendirmesi (SSVC)

İstismar: active
Otomatikleştirilebilir: no
Teknik etki: partial

Zaman çizelgesi

Numara ayrıldı2019-03-24
Yayımlandı2019-03-24 17:47
IP-DB'ye ulaştı2026-10-24 23:35
KEV'e eklendi2021-11-03
Son güncelleme2026-06-17 05:44

Numarayı veren (CNA): mitre
NVD durumu: Analyzed

Kaynakta görüntüle: CVE.org · NVD

Bu ürünlerde yeni bir açık çıktığında haber alın

E-posta uyarılarını aç

Ücretsiz · üyelikle · istediğiniz an kapatılır

Aynı üründe son açıklar — WordPress plugins & themes

7.2Yüksek

CVE-2026-116753 3 saat önce

Multi Step for Contact Form 7 <= 2.9.1 - Unauthenticated Stored Cross-Site Scripting via Multipart Field Name

ninjateam Multi Step for Contact Form 7

The Multi Step for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'multipart field name (array key)' parameter in all versions up to, and including, 2.9.1 due to insufficient input sanitization and output escaping. Th…

7.2Yüksek

CVE-2026-120687 3 saat önce

Lightbox & Modal Popup WordPress Plugin <= 2.8.7 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Image Alt Attribute in .wp-caption Containers

fooplugins Lightbox & Modal Popup WordPress Plugin – FooBox

The Lightbox & Modal Popup WordPress Plugin – FooBox plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'img alt attribute inside .wp-caption container' parameter in all versions up to, and including, 2.8.7 due to insufficient…

5.4Orta

CVE-2026-127115 3 saat önce

BuddyForms <= 2.10.6 - Unauthenticated Stored Cross-Site Scripting via 'title' Attribute of [bf_login_form] Shortcode

themekraft BuddyForms

The BuddyForms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'buddyforms_form_content' parameter in all versions up to, and including, 2.10.6 due to insufficient input sanitization and output escaping. This makes it possible for un…

6.4Orta

CVE-2026-110531 3 saat önce

FV Player 8 <= 8.1.9 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'Popup' Shortcode Attribute via Profile Video

foliovision FV Player 8

The FV Player 8 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'fv_player_videos' parameter in all versions up to, and including, 8.1.9 due to insufficient input sanitization and output escaping. This makes it possible for authentic…

8.8Yüksek

CVE-2026-18053 6 saat önce

MemberDash <= 1.8.7 - Authenticated (Subscriber+) Privilege Escalation to Administrator via Edit Profile 'id' Parameter

LearnDash MemberDash

The MemberDash plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.8.7. This is due to a mass-assignment vulnerability in the `user_account_manager()` function's edit_profile branch, where all submitted `$_POST` …

9.8Kritik

CVE-2026-19907 6 saat önce

Shipo 1.6 - 1.8.0 - Authentication Bypass to Administrator

shipo Shipo

The Shipo plugin for WordPress is vulnerable to Authentication Bypass in versions 1.6 through 1.8.0. This is due to the `authenticate_rest_user()` function parsing the `LOGGED_IN_COOKIE` value and authenticating the named user without verifying the cookie's c…