---
id: "CVE-2019-9978"
kind: "vulnerability"
aliases: ["CVE-2019-9978"]
title: "WordPress Social Warfare Plugin: WordPress Social Warfare Plugin Cross-Site Scripting (XSS) Vulnerability"
severity: "medium"
cvss: 6.1
epss: 0.72946
exploited: true
status: "open"
category: "package"
products: [{"name": "WordPress Social Warfare Plugin", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "package", "self-hosted", "social-warfare", "wordpress"]
not_affected_if: ["plugin-not-installed"]
published_at: "2019-03-24T15:29:00+00:00"
first_seen_at: "2026-10-23T19:11:53+00:00"
updated_at: "2026-10-23T20:29:43+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-9978", "first_seen_at": "2026-10-23T19:11:53+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2019-9978", "first_seen_at": "2026-10-23T19:13:43+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9978", "first_seen_at": "2026-10-23T19:35:23+00:00"}]
---

# WordPress Social Warfare Plugin: WordPress Social Warfare Plugin Cross-Site Scripting (XSS) Vulnerability

The Social Warfare WordPress plugin has a cross-site scripting flaw that lets an attacker inject script into pages served by the site. The sources describe the impact as remote code execution, and CISA lists it as actively exploited.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:WordPress Social Warfare Plugin affected ? fixed ?

## How to check

Check the installed Social Warfare or Social Warfare Pro plugin version in the WordPress admin plugins list; affected and fixed versions are unknown from the sources.

## Fix

Update Social Warfare and Social Warfare Pro to the latest vendor release, or remove the plugin if it is not needed; the exact fixed version is unknown from the sources.

## Timeline

- 2026-10-23T19:11:53+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-9978
- 2026-10-23T19:13:43+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2019-9978
- 2026-10-23T19:35:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2019-9978

## From the sources

WordPress Social Warfare plugin contains a cross-site scripting (XSS) vulnerability that allows for remote code execution. This vulnerability affects Social Warfare and Social Warfare Pro.

CISA required action: Apply updates per vendor instructions.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_