EUVD-2026-53169
GHSA-p46p-m4cq-5fh8
Severity by source
AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N
PR:H for required administrator access; AC:H for offline-state trigger dependency; UI:R because victim must enter an offline browser state for payload execution.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Super Progressive Web Apps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the superpwa_settings[offline_message_txt] setting in all versions up to, and including, 2.2.43. This is due to insufficient input sanitization and output escaping. The offline message value is stored without sanitization, passed to the frontend via wp_localize_script() without escaping, and rendered using innerHTML in the JavaScript snackbar component. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user triggers the offline snackbar.
AnalysisAI
Stored XSS in the Super Progressive Web Apps WordPress plugin (all versions through 2.2.43) enables authenticated WordPress administrators to persist arbitrary JavaScript payloads via the offline snackbar message setting, which executes in the browsers of site visitors when their browser transitions offline. The offline message is stored without sanitization, serialized into the page via wp_localize_script(), and rendered through innerHTML in the PWA snackbar component - a classic stored-to-DOM XSS chain crossing the administrator-to-visitor security boundary. No public exploit code or CISA KEV listing exists at time of analysis; the high privilege requirement substantially constrains real-world attack surface.
Technical ContextAI
The vulnerability affects the Super Progressive Web Apps plugin (CPE: cpe:2.3:a:superpwa:super_progressive_web_apps:*:*:*:*:*:*:*:*), which adds Progressive Web App capabilities to WordPress sites including offline support via a service worker (sw.php). The vulnerable setting superpwa_settings[offline_message_txt] is written to the WordPress options table without sanitization (no sanitize_text_field or wp_kses applied at save time). The value is then passed from PHP to JavaScript using WordPress's wp_localize_script() function, which serializes the data as inline JSON - it does not apply HTML or JavaScript escaping to individual values. The frontend JavaScript in register-sw.js (line 177) then assigns this value via innerHTML to the snackbar DOM element, allowing the browser to parse and execute embedded script content. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation): the defect spans both the storage layer (missing sanitization) and the output layer (missing escaping at both the wp_localize_script call and the JavaScript rendering step). The vulnerable code paths are documented in the plugin Trac browser at sw.php line 386 and register-sw.js line 177 for the 2.2.41 tag.
RemediationAI
Apply the upstream fix committed to the plugin's trunk via the WordPress Trac changeset at https://plugins.trac.wordpress.org/changeset?reponame=&new=3506063%40super-progressive-web-apps%2Ftrunk&old=3494263%40super-progressive-web-apps%2Ftrunk. The exact patched release version number is not confirmed by the available intelligence - the changeset targets trunk rather than a tagged release - so verify the current plugin version in the WordPress Plugin Directory before updating, and monitor for a formal release announcement. As a compensating control while awaiting a confirmed release, audit all WordPress Administrator accounts and revoke access for any accounts that are not operationally required; in managed or multi-tenant environments, restrict write access to plugin settings pages using capability filters. Disabling the PWA offline message feature entirely (by blanking the offline_message_txt setting) eliminates the attack surface at the cost of degraded offline UX for PWA visitors. A WAF rule blocking script-indicative patterns in the superpwa_settings[offline_message_txt] POST parameter is a viable short-term control but may be bypassed by obfuscated payloads.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today