superpwa vulnerabilities

Products

• Super Progressive Web Apps 2

Latest superpwa CVEs

Newest publication first

1. CVE-2026-5108 Super Progressive Web Apps <= 2.2.43 - Authenticated (Administrator+) Stored Cross-Site Scripting via Offline Message Setting

   Published 2026-08-05

   Medium·CVSS 4.4 EPSS 0.31%

   The Super Progressive Web Apps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the superpwa_settings[offline_message_txt] setting in all versions up to, and including, 2.2.43. This is due to insufficient input sanitization and output escaping. The offline me...

2. CVE-2023-48277 WordPress Super Progressive Web Apps plugin <= 2.2.21 - Broken Access Control vulnerability

   Published 2024-12-09

   Medium·CVSS 4.3 EPSS 0.61%

   Missing Authorization vulnerability in SuperPWA Super Progressive Web Apps super-progressive-web-apps allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Super Progressive Web Apps: from n/a through <= 2.2.21.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.