CVE-2026-5108 in Super Progressive Web Apps Plugin
Summary
by MITRE • 08/05/2026
The Super Progressive Web Apps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `superpwa_settings[offline_message_txt]` setting in all versions up to, and including, 2.2.43. This is due to insufficient input sanitization and output escaping. The offline message value is stored without sanitization, passed to the frontend via `wp_localize_script()` without escaping, and rendered using `innerHTML` in the JavaScript snackbar component. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user triggers the offline snackbar.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/05/2026
The Super Progressive Web Apps plugin for WordPress presents a critical stored cross-site scripting vulnerability that affects all versions up to and including 2.2.43. This vulnerability stems from inadequate input validation and output escaping mechanisms within the plugin's configuration handling. The flaw specifically resides in the `superpwa_settings[offline_message_txt]` parameter which serves as a user-controllable input field for defining offline messaging content. Attackers with administrator-level privileges or higher can exploit this weakness by injecting malicious scripts into the offline message setting, creating a persistent threat that executes whenever users encounter the offline snackbar component.
The technical implementation of this vulnerability demonstrates poor security practices in data handling and rendering processes. The plugin stores user-supplied input from the offline message field without proper sanitization, allowing potentially dangerous content to be persisted in the database. When the plugin renders this content for frontend display, it passes the unescaped value through `wp_localize_script()` function which makes the data available to JavaScript contexts. The subsequent rendering occurs through `innerHTML` assignment in the JavaScript snackbar component, creating an ideal environment for cross-site scripting attacks as defined by CWE-79. This approach bypasses standard HTML escaping mechanisms and directly injects malicious code into the browser's DOM.
The operational impact of this vulnerability extends beyond simple script execution, as it provides attackers with complete control over the affected WordPress installation from within the administrative context. Since the vulnerability requires only administrator-level access or higher, it represents a significant risk to WordPress sites where privileged accounts may be compromised or where attackers have gained administrative privileges through other means. The stored nature of this XSS vulnerability means that malicious scripts remain active even after the initial injection, continuously executing against any user who triggers the offline snackbar functionality. This creates persistent attack vectors that can be used for session hijacking, credential theft, or further privilege escalation attempts.
Security practitioners should immediately implement mitigations including updating to patched versions of the plugin where available, implementing strict input validation for all user-controllable settings, and applying output escaping mechanisms before rendering any user-supplied content in JavaScript contexts. Organizations should also consider implementing additional security controls such as role-based access restrictions, regular security audits of plugin configurations, and monitoring for unauthorized changes to critical settings. The vulnerability aligns with ATT&CK technique T1548.001 for privilege escalation through modification of application configuration and demonstrates the importance of following secure coding practices outlined in CWE-79 guidelines for preventing cross-site scripting vulnerabilities. Organizations should also conduct thorough security assessments of their WordPress installations to identify similar issues in other plugins or themes that may present analogous risks through improper input handling or output escaping mechanisms.