Super Progressive Web Apps Vulnerabilities

The Super Progressive Web Apps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `superpwa_settings[offline_message_txt]` setting in all versions up to, and including, 2.2.43. This is due to insufficient input sanitization and output escaping. The offline message value is stored without sanitiza...

CVSS:

4.4

Affected:

up to 2.2.43

Fixed in:

2.2.44

Disclosed:

Aug 4, 2026

CVE-2026-5108 on NVD →

The Super Progressive Web Apps plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the superpwa_newsletter_submit() function hooked via a nopriv AJAX action in versions up to, and including, 2.2.21. This makes it possible for unauthenticated attackers to subscrib...

CVSS:

5.3

Affected:

up to 2.2.21

Fixed in:

2.2.22

Disclosed:

Nov 22, 2023

CVE-2023-48277 on NVD →

The Super Progressive Web Apps plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the superpwa_send_feedback function in versions up to, and including, 2.2.8. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to submit feedback...

CVSS:

4.3

Affected:

up to 2.2.8

Fixed in:

2.2.9

Disclosed:

Nov 29, 2022