Social Sharing Plugin – Social Warfare
social-warfare · plugin
Known security vulnerabilities for Social Sharing Plugin – Social Warfare. Find out in seconds which version runs on your site with WP Lens.
8 known vulnerabilities
1 actively exploited (CISA KEV) · 1 critical · 4 exploitable without logging in · 3 with public exploit code · latest Feb 22, 2025
Listed on wordpress.org · latest 4.5.6 · last updated Mar 18, 2025 · 10K+ installs
wordpress.org status checked on Oct 2, 2026
Vulnerabilities
- Medium 6.1
CVE-2019-9978KEVunauthenticated · needs a click
The social-warfare plugin before 3.5.3 for WordPress has stored XSS via the wp-admin/admin-post.php?swp_debug=load_options swp_url parameter
- Critical 10.0
CVE-2024-6297unauthenticated≤ 4.4.7.1
Several WordPress.org Plugins <= Various Versions - Injected Backdoor
- Medium 6.5
CVE-2025-26973login required≤ 4.5.5
WordPress Social Warfare Plugin <= 4.5.5 - Cross Site Scripting (XSS) vulnerability
- Medium 6.4
CVE-2024-1959contributor+≤ 4.4.6.1
Social Sharing Plugin – Social Warfare <= 4.4.6.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode
- Medium 5.4
CVE-2023-0403unauthenticated · needs a click≤ 4.3.1
Social Warfare <= 4.3.1 - Cross-Site Request Forgery
- Medium 5.4
CVE-2023-0402subscriber+≤ 4.3.0
Social Warfare <= 4.3.0 - Missing Authorization
- Medium 5.4
CVE-2023-4842contributor+≤ 4.4.3
Social Sharing Plugin - Social Warfare <= 4.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- Medium 4.3
CVE-2024-34825unauthenticated · needs a click≤ 4.4.5.1
WordPress Social Warfare plugin <= 4.4.5.1 - Cross Site Request Forgery (CSRF) vulnerability
The access label is read from the record's own text (e.g. “subscriber+”: subscriber and above). When the text names no role, CVSS decides between “login required” and “high privilege”; no role name is invented. “Needs a click”: the attack depends on a logged-in user following a link (CSRF, reflected XSS).