Super Progressive Web Apps offline message reaches innerHTML as stored XSS
Super Progressive Web Apps through 2.2.43 stores superpwa_settings[offline_message_txt] without sanitization, exports the value to frontend JavaScript through wp_localize_script(), and assigns it to innerHTML in the snackbar component. An Administrator can store JavaScript that executes for users who trigger the offline snackbar. This 4.4-scored record received deeper review because the persistent frontend payload can reach site visitors, including another administrator. The CNA does not disclose the settings action or PHP save handler.
- Component
- Super Progressive Web Apps
- Plugin slug
super-progressive-web-apps- Affected
- <= 2.2.43
- Safe version
> 2.2.43- Published
- Aug 05, 2026
This CVE was published Aug 05, 2026 and is one of 2 known issues for this plugin.
Update, patch or deactivate.
Update Super Progressive Web Apps to a release after 2.2.43. The authoritative record links a trunk correction but does not identify the first fixed release. Review the offline message setting for unexpected markup and clear affected caches and service-worker content.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The Super Progressive Web Apps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `superpwa_settings[offline_message_txt]` setting in all versions up to, and including, 2.2.43. This is due to insufficient input sanitization and output escaping. The offline message value is stored without sanitization, passed to the frontend via `wp_localize_script()` without escaping, and rendered using `innerHTML` in the JavaScript snackbar component. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user triggers the offline snackbar.
CVE / CNA vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N