Stored Cross-Site Scripting in Super Progressive Web Apps by WordPress

CVE-2026-5108

What is CVE-2026-5108?

The Super Progressive Web Apps plugin for WordPress has a vulnerability that allows for Stored Cross-Site Scripting (XSS) through the superpwa_settings[offline_message_txt] parameter. This issue arises from inadequate input sanitization and output escaping, where user input is directly stored and later rendered on the frontend. Authenticated users with Administrator-level access can exploit this weakness to inject harmful scripts, potentially affecting other users when they interact with the offline snackbar feature. The vulnerability persists in all versions up to 2.2.43, highlighting the need for updates and better input validation measures.

References