CVE-2026-5108 Overview
CVE-2026-5108 is a stored Cross-Site Scripting (XSS) vulnerability in the Super Progressive Web Apps plugin for WordPress. The flaw affects all versions up to and including 2.2.43. It resides in the superpwa_settings[offline_message_txt] setting, where the plugin fails to sanitize input, escape output, or safely render values in the browser. Authenticated attackers with Administrator-level privileges can inject arbitrary JavaScript that executes when a user triggers the offline snackbar component. The vulnerability is classified under [CWE-79].
Critical Impact
Authenticated administrators can persist arbitrary JavaScript in plugin settings, which then executes in the browser of any visitor who triggers the offline snackbar UI.
Affected Products
- Super Progressive Web Apps plugin for WordPress
- All versions up to and including 2.2.43
- WordPress sites using the plugin's offline snackbar feature
Discovery Timeline
- 2026-08-05 - CVE-2026-5108 published to NVD
- 2026-08-05 - Last updated in NVD database
Technical Details for CVE-2026-5108
Vulnerability Analysis
The vulnerability is a stored XSS in the plugin's offline message configuration. When an administrator saves a value in the superpwa_settings[offline_message_txt] field, the plugin persists the string in the WordPress options table without input sanitization. The plugin then exposes that stored value to the frontend using wp_localize_script(), which does not perform HTML escaping. The client-side register-sw.js script assigns the value directly to innerHTML when rendering the offline snackbar component. This chain of unsanitized storage, unescaped transport, and unsafe DOM insertion allows JavaScript payloads to execute in the visitor's browser context.
Root Cause
The root cause is a failure to sanitize on input and escape on output. WordPress provides sanitization helpers such as sanitize_text_field() for storage and esc_html() or esc_js() for output, but the plugin uses none of them on this setting. Assigning tainted data to innerHTML instead of textContent completes the injection path.
Attack Vector
An attacker must first obtain Administrator-level access to the WordPress site. Once authenticated, the attacker submits a payload through the plugin's settings interface, storing script content in the offline message field. The payload executes for any visitor whose browser triggers the offline snackbar, including other logged-in administrators. Because the payload runs in the site's origin, it can perform actions such as session token theft, forced administrative requests, or malicious redirects. The high privilege requirement limits practical exploitation to scenarios involving compromised admin accounts, insider threats, or multi-admin sites with mixed trust levels.
No verified exploit code is publicly available. Technical details are documented in the Wordfence Vulnerability Report and the WordPress Changeset Details.
Detection Methods for CVE-2026-5108
Indicators of Compromise
- Unexpected HTML tags, <script> blocks, or event handler attributes stored in the superpwa_settings option in the wp_options table.
- Outbound requests from visitor browsers to unfamiliar domains shortly after the offline snackbar renders.
- Unauthorized administrator account creation, plugin installation, or theme edits following an admin session.
Detection Strategies
- Query the WordPress database for the superpwa_settings option and inspect the offline_message_txt value for HTML or JavaScript syntax.
- Review audit logs for changes to Super Progressive Web Apps settings, correlating with the account that made the change.
- Deploy a Content Security Policy (CSP) in report-only mode to surface inline script execution originating from plugin-rendered components.
Monitoring Recommendations
- Alert on modifications to plugin settings by any administrator and require secondary review for changes containing angle brackets or on* attributes.
- Monitor for anomalous administrator logins, especially from new IP addresses or geographies, that precede plugin configuration changes.
- Track browser console errors and CSP violation reports from public site visitors as an early signal of injected content.
How to Mitigate CVE-2026-5108
Immediate Actions Required
- Update the Super Progressive Web Apps plugin to a version later than 2.2.43 that includes the fix referenced in the WordPress changeset.
- Audit the current value of superpwa_settings[offline_message_txt] and reset it to a plain-text default if any HTML or script content is present.
- Review all Administrator accounts, remove unused accounts, and enforce multi-factor authentication for remaining administrators.
Patch Information
The vendor addressed the issue in the plugin trunk. Refer to the WordPress Changeset Details for the exact code changes, and to the WordPress Script File and WordPress Service Worker File for the vulnerable code paths.
Workarounds
- Restrict access to the plugin's settings page using capability filters or an administrative role management plugin until patching is complete.
- Set a static, non-HTML value for the offline message and monitor the database option for unauthorized changes.
- Deploy a strict Content Security Policy that disallows inline scripts on the public site to blunt injected payloads.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
