What is the CVSS score of EUVD-2026-53169?

EUVD-2026-53169 has a CVSS 3.1 base score of 4.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Super Progressive Web Apps EUVD-2026-53169

| CVE-2026-5108 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-08-05 Wordfence

GHSA-p46p-m4cq-5fh8

WordPress XSS Wordpress Plugin Super Progressive Web Apps

4.4

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

4.4 MEDIUM

AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N

vuln.today AI

4.0 MEDIUM

PR:H for required administrator access; AC:H for offline-state trigger dependency; UI:R because victim must enter an offline browser state for payload execution.

3.1 AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:H/AT:P/PR:H/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 05, 2026 - 07:46 vuln.today

CVE Published

Aug 05, 2026 - 06:37 cve.org

MEDIUM 4.4

DescriptionCVE.org

The Super Progressive Web Apps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the superpwa_settings[offline_message_txt] setting in all versions up to, and including, 2.2.43. This is due to insufficient input sanitization and output escaping. The offline message value is stored without sanitization, passed to the frontend via wp_localize_script() without escaping, and rendered using innerHTML in the JavaScript snackbar component. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user triggers the offline snackbar.

AnalysisAI

Stored XSS in the Super Progressive Web Apps WordPress plugin (all versions through 2.2.43) enables authenticated WordPress administrators to persist arbitrary JavaScript payloads via the offline snackbar message setting, which executes in the browsers of site visitors when their browser transitions offline. The offline message is stored without sanitization, serialized into the page via wp_localize_script(), and rendered through innerHTML in the PWA snackbar component - a classic stored-to-DOM XSS chain crossing the administrator-to-visitor security boundary. No public exploit code or CISA KEV listing exists at time of analysis; the high privilege requirement substantially constrains real-world attack surface.

Technical ContextAI

The vulnerability affects the Super Progressive Web Apps plugin (CPE: cpe:2.3:a:superpwa:super_progressive_web_apps:*:*:*:*:*:*:*:*), which adds Progressive Web App capabilities to WordPress sites including offline support via a service worker (sw.php). The vulnerable setting superpwa_settings[offline_message_txt] is written to the WordPress options table without sanitization (no sanitize_text_field or wp_kses applied at save time). The value is then passed from PHP to JavaScript using WordPress's wp_localize_script() function, which serializes the data as inline JSON - it does not apply HTML or JavaScript escaping to individual values. The frontend JavaScript in register-sw.js (line 177) then assigns this value via innerHTML to the snackbar DOM element, allowing the browser to parse and execute embedded script content. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation): the defect spans both the storage layer (missing sanitization) and the output layer (missing escaping at both the wp_localize_script call and the JavaScript rendering step). The vulnerable code paths are documented in the plugin Trac browser at sw.php line 386 and register-sw.js line 177 for the 2.2.41 tag.

RemediationAI

Apply the upstream fix committed to the plugin's trunk via the WordPress Trac changeset at https://plugins.trac.wordpress.org/changeset?reponame=&new=3506063%40super-progressive-web-apps%2Ftrunk&old=3494263%40super-progressive-web-apps%2Ftrunk. The exact patched release version number is not confirmed by the available intelligence - the changeset targets trunk rather than a tagged release - so verify the current plugin version in the WordPress Plugin Directory before updating, and monitor for a formal release announcement. As a compensating control while awaiting a confirmed release, audit all WordPress Administrator accounts and revoke access for any accounts that are not operationally required; in managed or multi-tenant environments, restrict write access to plugin settings pages using capability filters. Disabling the PWA offline message feature entirely (by blanking the offline_message_txt setting) eliminates the attack surface at the cost of degraded offline UX for PWA visitors. A WAF rule blocking script-indicative patterns in the superpwa_settings[offline_message_txt] POST parameter is a viable short-term control but may be bypassed by obfuscated payloads.