CVE-2026-32570: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in DaftPlug Progressify - Progressive Web App (PWA)

CVE-2026-32570 is an unauthenticated Cross-Site Scripting (CWE-79) vulnerability in Progressify - Progressive Web App (PWA) versions up to 1.6.0. The flaw involves improper neutralization of input during web page generation, enabling remote attackers to inject and execute arbitrary scripts in the context of the affected application. The vulnerability has a CVSS 3.1 base score of 7.1, indicating high severity with network attack vector, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality, integrity, and availability with scope changed.

Successful exploitation of this vulnerability can lead to execution of arbitrary scripts in the victim's browser, potentially resulting in data theft, session hijacking, or other malicious actions affecting confidentiality, integrity, and availability of the application and its users. The vulnerability is exploitable remotely without authentication, increasing the risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is provided at this time. Until a patch is available, consider applying input validation and output encoding controls as temporary mitigations if feasible.