CVE-2019-9978

A WordPress plugin called Social Warfare has a flaw where attackers can store malicious code in a specific parameter, which then gets executed when administrators view certain pages. This allows attackers to steal admin credentials or take control of the website.

Stored XSS vulnerability in Social Warfare plugin versions before 3.5.3, exploitable via the swp_url parameter in wp-admin/admin-post.php?swp_debug=load_options. Attack requires administrative access to the vulnerable parameter endpoint; malicious payload persists in storage and executes in admin browsers, potentially leading to session hijacking or unauthorized administrative actions.