WordPress Social Warfare Plugin Cross-Site Scripting (XSS) Vulnerability
CVSS score
—
EPSS probability
%72.9
Risk score
—
Published
5 y ago
Public Exploits · GitHub and Metasploit Intelligence
This tab scans the sources that NVD labels as exploits, GitHub repositories matching the CVE identifier and Rapid7 Metasploit Framework modules. Only links to sources that were actually found are shown.
Social Warfare WordPress Plugin 3.5.2 - Remote Code Execution (RCE)
WordPress Plugin Social Warfare < 3.5.3 - Remote Code Execution
Nuclei: WordPress Social Warfare <3.5.3 - Cross-Site Scripting
Penetration test report for MegaQuagga Publishing documenting a six-phase engagement that chained CVE-2019-9978 and CVE-2023-4842 to achieve unauthenticated Remote Code Execution and a persistent Meterpreter session. Includes full methodology, exploitation evidence, and prioritized remediation recommendations.
A Remote Code Execution (RCE) vulnerability in the Social Warfare plugin for WordPress, affecting versions below 3.5.3.
python3 version of the CVE-2019-9978 exploit
The `swp_debug` parameter in `admin-post.php` allows remote attackers to include external files containing malicious PHP code, which are evaluated on the server. By supplying a crafted URL that hosts a reverse shell payload, an attacker can gain command execution.
A complete walkthrough and exploit for CVE-2019-9978 - Unauthenticated Remote Code Execution in Social Warfare WordPress plugin ≤ 3.5.2. Includes vulnerable code analysis and payload examples.
A custom Python proof-of-concept showcasing root-cause analysis and exploitation of CVE 2019-9978 (Social Warfare plugin),focusing on practical RFI to RCE attack flow.
Similar Vulnerabilities
Vulnerability in WordPress
WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution
WordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_Query
Unrestricted file upload in WordPress
Cross-site scripting in WordPress
WordPress < 6.3.2 is vulnerable to Broken Access Control
Get this vulnerability through the API
Affected products, version ranges, exploitation status and patch information in a single request, with a free key.
curl -H "x-api-key: $DAYBREACH_API_KEY" \ "https://api.daybreach.dev/api/v1/intel/cves/CVE-2019-9978"