What’s Vulnerable › Products

WofficeIO Woffice Core vulnerabilities

14 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 11 published in the last 12 months.

Check whether your WofficeIO Woffice Core version is affected

Latest WofficeIO Woffice Core vulnerabilities

• CVE-2026-39747 — WordPress Woffice theme <= 5.4.35 - SQL Injection vulnerability (CVSS 8.5)
• CVE-2026-27435 — WordPress Woffice theme < 5.4.33 - Broken Access Control vulnerability (CVSS 5.3)
• CVE-2025-67919 — WordPress Woffice Core plugin <= 5.4.30 - Insecure Direct Object References (IDOR) vulnerability (CVSS 6.5)
• CVE-2025-67918 — WordPress Woffice theme <= 5.4.30 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
• CVE-2025-67566 — WordPress Woffice Core plugin <= 5.4.30 - Broken Access Control vulnerability (CVSS 5.3)
• CVE-2025-7694 — Woffice Core <= 5.4.26 - Authenticated (Contributor+) Arbitrary File Deletion (CVSS 7.5)
• CVE-2025-2798 — Woffice <= 5.4.21 - Authentication Bypass via Registration Role (CVSS 9.8)
• CVE-2025-2797 — Woffice Core <= 5.4.21 - Cross-Site Request Forgery to User Registration Approval (CVSS 5.4)
• CVE-2025-2780 — Woffice Core <= 5.4.21 - Authenticated (Subscriber+) Arbitrary File Upload (CVSS 8.8)
• CVE-2024-43234 — WordPress Woffice theme <= 5.4.14 - Unauthenticated Account Takeover vulnerability (CVSS 9.8)
• CVE-2024-37470 — WordPress Woffice Core plugin <= 5.4.8 - Unauthenticated Broken Access Control vulnerability (CVSS 9.8)
• CVE-2024-43153 — WordPress Woffice theme <= 5.4.10 - Unauthenticated Privilege Escalation vulnerability (CVSS 9.8)
• CVE-2024-37472 — WordPress Woffice theme <= 5.4.8 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 6.1)
• CVE-2024-37471 — WordPress Woffice Core plugin <= 5.4.8 - Site Wide Reflected Cross Site Scripting (XSS) vulnerability (CVSS 6.1)