CVE-2019-9978

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

The vulnerability is a stored cross-site scripting flaw, identified as CWE-79, that exists in the Social Warfare and Social Warfare Pro plugins for WordPress prior to version 3.5.3. It is triggered through the swp_url parameter when the wp-admin/admin-post.php endpoint is accessed with the swp_debug=load_options query string, allowing attacker-supplied script to be persisted and later executed.

An unauthenticated remote attacker can supply a crafted swp_url value that stores malicious JavaScript within the WordPress installation. When an administrator or other privileged user subsequently interacts with the affected administrative interface, the script executes in the victim's browser context, enabling theft of session tokens, account takeover, or further site modification under the CVSS vector AV:N/AC:L/PR:N/UI:R/S:C.

Public references, including the Sucuri analysis and the vendor's March 2019 Twitter statement, indicate that the issue was addressed by releasing version 3.5.3; the WordPress plugin directory changelog confirms the availability of the patched release. The CVE record notes that the vulnerability was exploited in the wild in March 2019, with multiple public proof-of-concept artifacts describing remote code execution chains built on the underlying XSS primitive.