CVE-2026-5108 is a stored cross-site scripting vulnerability in the Super Progressive Web Apps WordPress plugin (versions up to and including 2.2.43). The issue stems from insufficient input sanitization and output escaping of the `superpwa_settings[offline_message_txt]` setting. The offline message is stored without sanitization, passed to the frontend via `wp_localize_script()` without escaping, and rendered using `innerHTML` in the JavaScript snackbar component. This allows authenticated attackers with Administrator privileges to inject arbitrary JavaScript that executes whenever the offline snackbar is triggered.

An attacker with Administrator-level access can inject malicious scripts that execute in the context of users viewing the offline snackbar message. This can lead to limited confidentiality and integrity impacts, such as theft of session tokens or manipulation of page content. There is no impact on availability. The vulnerability requires high privileges and no user interaction is needed beyond triggering the offline snackbar.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Administrator-level access to trusted users only to reduce risk. Monitor for updates from the plugin vendor regarding patches or official mitigations.