CVE-2026-5108
Received Received - Intake

Stored XSS in Super Progressive Web Apps WordPress Plugin

Publication date: 2026-08-05

Last updated on: 2026-08-05

Assigner: Wordfence

Description
The Super Progressive Web Apps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `superpwa_settings[offline_message_txt]` setting in all versions up to, and including, 2.2.43. This is due to insufficient input sanitization and output escaping. The offline message value is stored without sanitization, passed to the frontend via `wp_localize_script()` without escaping, and rendered using `innerHTML` in the JavaScript snackbar component. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user triggers the offline snackbar.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-05
Last Modified
2026-08-05
Generated
2026-08-05
AI Q&A
2026-08-05
EPSS Evaluated
N/A
NVD
CVE-2026-5108
EUVD
EUVD-2026-53169

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
super_progressive_web_apps super_progressive_web_apps to 2.2.43 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Stored Cross-Site Scripting (XSS) vulnerability in the Super Progressive Web Apps WordPress plugin up to version 2.2.43. It allows authenticated attackers with Administrator access or higher to inject malicious scripts via the offline message setting. The scripts execute when users trigger the offline snackbar component due to insufficient input sanitization and output escaping.

Detection Guidance

Check WordPress installations for the Super Progressive Web Apps plugin version 2.2.43 or lower. Look for unauthorized script injections in the offline message settings via the WordPress admin panel.

Impact Analysis

If exploited, this vulnerability could allow attackers to steal user sessions, deface websites, or perform actions on behalf of users. It requires Administrator-level access but could impact all site visitors when the snackbar is triggered.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR (data protection) and HIPAA (health data privacy) requirements. It may result in non-compliance penalties if exploited to exfiltrate sensitive user data.

Mitigation Strategies

Update the Super Progressive Web Apps plugin to the latest version. Review and sanitize the offline message settings to remove any malicious scripts. Restrict Administrator-level access to trusted users only.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-5108. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart