The social-warfare plugin before 3.5.3 for WordPress has stored XSS via the wp-admin/admin-post.php?swp_debug=load_options swp_url parameter, as exploited in the wild in March 2019. This affects Social Warfare and Social Warfare Pro.

The WordPress application running on the remote host has a version of the 'Social Warfare' plugin that is prior to 3.5.3 and, thus, is affected by a stored cross site scripting vulnerability in the wp-admin/admin-post.php?swp_debug=load_options swp_url parameter.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The WordPress Social Warfare Plugin installed on the remote host is affected by an eval() injection vulnerability due to a failure to properly sanitize user-supplied input to the 'swp_url' parameter. An unauthenticated, remote attacker can leverage this issue to escalate privileges and execute arbitrary code on the affected host.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
159570	WordPress Plugin 'Social Warfare' < 3.5.3 XSS	Nessus	CGI abuses	Remote	medium
98528	Social Warfare Plugin for WordPress < 3.5.3 Remote Code Execution	Web App Scanning	Component Vulnerability	Version Based	medium

Detections

Analytics

CVE-2019-9978

medium

Tenable Plugins

medium

medium