Progressify PWA EUVD-2026-93233

Exploitation requires a victim to interact with an attacker-supplied link or crafted request (UI:R in the CVSS vector) that reaches a vulnerable, unsanitized input-handling path in the Progressify - Progressive Web App (PWA) plugin version 1.6.0 or earlier on a WordPress site. No authentication is required (PR:N), so any unauthenticated remote attacker can craft the payload, but the attack cannot complete without the victim clicking/visiting - this user-interaction requirement is the primary limiting factor. The specific injectable parameter or endpoint is not named in the available description; defenders should treat any site running the plugin at <= 1.6.0 as exposed and upgrade past 1.6.0.

This is a moderate-severity reflected/stored Cross-Site Scripting flaw (CWE-79) with a CVSS 3.1 base score of 7.1. The vector (AV:N/AC:L/PR:N/UI:R/S:C) indicates network-reachable, low-complexity, unauthenticated exploitation, but critically requires user interaction (UI:R) - a victim must click a crafted link or visit an attacker-influenced page, which meaningfully limits mass automated exploitation. The scope change (S:C) reflects that injected script executes in the victim's browser context rather than the WordPress backend, and impacts are capped at Low across confidentiality, integrity, and availability. No EPSS score, SSVC decision, KEV listing, or public POC was provided in the intelligence set; therefore there is no public exploit identified at time of analysis and no evidence of active exploitation. The practical risk is elevated by the unauthenticated nature (PR:N) but tempered by the UI:R requirement and the typically low real-world install base of this specific plugin - this reads as a real-but-not-urgent issue rather than a top-priority emergency. Note the A:L (availability) impact is somewhat unusual for an XSS finding and appears to be Patchstack/NVD scoring convention rather than a distinct availability attack; defenders should treat the dominant impact as session/browser-context compromise.

An attacker crafts a malicious URL or payload targeting a vulnerable parameter in the Progressify PWA plugin (<= 1.6.0) and lures a WordPress site visitor or administrator into clicking it. When the page renders the unsanitized input, attacker-controlled JavaScript executes in the victim's browser session, enabling session token theft, actions on behalf of the victim, or redirection to attacker infrastructure. No authentication is required to deliver the payload, but the attack depends on victim interaction, and no public exploit code was identified at time of analysis.