Description
The Super Progressive Web Apps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `superpwa_settings[offline_message_txt]` setting in all versions up to, and including, 2.2.43. This is due to insufficient input sanitization and output escaping. The offline message value is stored without sanitization, passed to the frontend via `wp_localize_script()` without escaping, and rendered using `innerHTML` in the JavaScript snackbar component. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user triggers the offline snackbar.
Published: 2026-08-05
Score: 4.4 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability allows an authenticated administrator to embed malicious scripts in the offline message setting. When the offline snackbar is displayed to site visitors, the unescaped text is injected into the page via innerHTML, causing the script to run with the page’s privileges.

Affected Systems

The affected product is the WordPress plugin Super Progressive Web Apps, versions 2.2.43 and earlier. Any site running a vulnerable version can be compromised by an admin user.

Risk and Exploitability

With a CVSS score of 4.4, the risk is considered low; however, it requires administrative credentials, which limits the number of potential attackers. Because it is not listed in KEV and the EPSS score is unavailable, it is unlikely to be widely exploited at present, but the ability to run arbitrary scripts remains a significant threat if an attacker gains admin access.

Generated by OpenCVE AI on August 5, 2026 at 08:30 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update Super Progressive Web Apps to version 2.2.44 or later to fix the XSS vulnerability.
  • Review and restrict administrator accounts, ensuring only trusted users have the ability to modify plugin settings.
  • Implement a Content Security Policy that disallows inline scripts to mitigate potential XSS if the plugin cannot be updated immediately.

Generated by OpenCVE AI on August 5, 2026 at 08:30 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 05 Aug 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 05 Aug 2026 10:45:00 +0000

Type Values Removed Values Added
First Time appeared Superpwa
Superpwa super Progressive Web Apps
Wordpress
Wordpress wordpress
Vendors & Products Superpwa
Superpwa super Progressive Web Apps
Wordpress
Wordpress wordpress

Wed, 05 Aug 2026 07:30:00 +0000

Type Values Removed Values Added
Description The Super Progressive Web Apps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `superpwa_settings[offline_message_txt]` setting in all versions up to, and including, 2.2.43. This is due to insufficient input sanitization and output escaping. The offline message value is stored without sanitization, passed to the frontend via `wp_localize_script()` without escaping, and rendered using `innerHTML` in the JavaScript snackbar component. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user triggers the offline snackbar.
Title Super Progressive Web Apps <= 2.2.43 - Authenticated (Administrator+) Stored Cross-Site Scripting via Offline Message Setting
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 4.4, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N'}

Subscriptions

Superpwa Super Progressive Web Apps
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-08-05T14:27:19.325Z

Reserved: 2026-03-29T18:52:21.942Z

Link: CVE-2026-5108

cve-icon Vulnrichment

Updated: 2026-08-05T14:23:47.935Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-05T10:18:24Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')