CVE-2026-5108
medium
📛 Threat Title
Super Progressive Web Apps <= 2.2.43 - Authenticated (Administrator+) Stored Cross-Site Scripting via Offline Message Setting
Description
The Super Progressive Web Apps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `superpwa_settings[offline_message_txt]` setting in all versions up to, and including, 2.2.43. This is due to insufficient input sanitization and output escaping. The offline message value is stored without sanitization, passed to the frontend via `wp_localize_script()` without escaping, and rendered using `innerHTML` in the JavaScript snackbar component. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user triggers the offline snackbar. Affected software — plugin: Super Progressive Web Apps (affected: *-2.2.43). CVSS 4.4 (Medium) — CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N.
Indicators of Compromise (1)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
cve
CVE-2026-5108
IOC database
- Type
- cve
- Value
CVE-2026-5108- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Super Progressive Web Apps <= 2.2.43 - Authenticated (Administrator+) Stored Cross-Site Scripting via Offline Message Setting
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
References (3)
Remediations (1)
-
Wordfence remediation: Super Progressive Web AppsWordfence
Update to version 2.2.44, or a newer patched version
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.