CVE-2026-5108 superpwa CVE debrief

Who should care

Administrators and users of the Super Progressive Web Apps plugin for WordPress should be aware of this vulnerability and take necessary actions to protect their sites. This includes reviewing the plugin's configuration, ensuring that all user input is properly sanitized and escaped, and monitoring for potential attacks. Additionally, affected operators, platform administrators, and security teams should assess their exposure and prioritize remediation efforts. Those with Administrator-level access and above should be particularly cautious, as they have the ability to inject arbitrary web scripts. It is also essential for vulnerability management teams to track and verify the remediation status of affected assets. Security teams should review and update their incident response plans to address potential exploitation of this vulnerability. Furthermore, platform administrators should ensure that all necessary security controls are in place to prevent exploitation, such as restricting Administrator-level access and implementing compensating controls for exposed systems. By taking these steps, organizations can minimize the risk associated with this vulnerability and protect their sites from potential attacks. The CVE record and NVD entry provide details on the vulnerability, including its CVSS score of 4.4 and severity of MEDIUM. However, further information about the affected scope and vendor remediation is limited, emphasizing the need for defensive verification tasks and evidence-based decision-making. To ensure comprehensive protection, it is crucial to stay informed about the latest developments and updates related to this vulnerability, and to collaborate with relevant stakeholders to address potential risks and vulnerabilities. This may involve conducting regular security audits, implementing robust monitoring and detection mechanisms, and maintaining open lines of communication with vendors and other stakeholders. By adopting a proactive and collaborative approach, organizations can effectively manage the risks associated with this vulnerability and maintain the security and integrity of their systems and data. Finally, it is essential to prioritize ongoing

Technical summary

The Super Progressive Web Apps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `superpwa_settings[offline_message_txt]` setting. The offline message value is stored without sanitization, passed to the frontend without escaping, and rendered using `innerHTML` in the JavaScript snackbar component. This allows authenticated attackers with Administrator-level access and above to inject arbitrary web scripts.

Defensive priority

Administrators should prioritize updating the Super Progressive Web Apps plugin to a version beyond 2.2.43 and ensure that all user input is properly sanitized and escaped.

Recommended defensive actions

• Update the Super Progressive Web Apps plugin to a version beyond 2.2.43
• Ensure that all user input is properly sanitized and escaped
• Monitor for and restrict Administrator-level access and above
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its CVSS score of 4.4 and severity of MEDIUM. However, further information about the affected scope and vendor remediation is limited.

Official resources