Vulnerabilities

TI-2026-67946 CVE-2026-39747 · GHSA-r68f-37wm-v5h4

SQL injection in WordPress Woffice theme

LOW 37

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WofficeIO Woffice woffice allows SQL Injection.This issue affects Woffice: from n/a before 5.4.43.

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.00332 Published 2026-10-06 Fixed in 5.4.43 CWE-89

TI-2026-21846 CVE-2026-27435 · GHSA-xw5j-5p2q-fr86

WordPress Woffice theme < 5.4.33 - Broken Access Control vulnerability

LOW 30

Missing Authorization vulnerability in WofficeIO Woffice allows Exploiting Incorrectly Configured Access Control Security Levels.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00294 Published 2026-07-01 Fixed in 5.4.33 CWE-862

TI-2025-41528 CVE-2025-67919 · GHSA-rhq7-g7ch-6mm7

WordPress Woffice Core plugin <= 5.4.30 - Insecure Direct Object References (IDOR) vulnerability

LOW 35

Authorization Bypass Through User-Controlled Key vulnerability in WofficeIO Woffice Core woffice-core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Woffice Core: from n/a thro…

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00314 Published 2026-01-08 No fix listed CWE-639

TI-2025-41527 CVE-2025-67918 · GHSA-635h-3q6f-64px

WordPress Woffice theme <= 5.4.30 - Cross Site Scripting (XSS) vulnerability

LOW 31

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WofficeIO Woffice woffice allows Reflected XSS.This issue affects Woffice: from n/a through <= 5.4.30.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00219 Published 2026-01-08 No fix listed CWE-79

TI-2025-41320 CVE-2025-67566 · GHSA-pvpc-5j5f-m2fm

WordPress Woffice Core plugin <= 5.4.30 - Broken Access Control vulnerability

LOW 30

Missing Authorization vulnerability in WofficeIO Woffice Core woffice-core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Woffice Core: from n/a through <= 5.4.30.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.0032 Published 2025-12-09 No fix listed CWE-862

TI-2025-07021 CVE-2025-7694 · GHSA-7rpq-f876-wqqx

Woffice Core <= 5.4.26 - Authenticated (Contributor+) Arbitrary File Deletion

LOW 37

The Woffice Core plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the woffice_file_manager_delete() function in all versions up to, and including, 5.4.26.

CVSS 3.1HIGH 7.5 Network Low privileges No interaction EPSS 0.01053 Published 2025-08-02 No fix listed CWE-22

TI-2025-02442 CVE-2025-2798 · GHSA-36cx-c3wx-4c25

Woffice <= 5.4.21 - Authentication Bypass via Registration Role

MEDIUM 50

The Woffice CRM theme for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.4.21.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00675 Published 2025-04-04 No fix listed CWE-269

TI-2025-02430 CVE-2025-2780 · GHSA-w6f5-g24g-5g9g

Woffice Core <= 5.4.21 - Authenticated (Subscriber+) Arbitrary File Upload

MEDIUM 48

The Woffice Core plugin for WordPress, used by the Woffice Theme, is vulnerable to arbitrary file uploads due to missing file type validation in the 'saveFeaturedImage' function in all versions up to, and including, 5.4.…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00849 Published 2025-04-04 No fix listed CWE-434

TI-2025-02441 CVE-2025-2797 · GHSA-xv4w-vgqg-qwrq

Woffice Core <= 5.4.21 - Cross-Site Request Forgery to User Registration Approval

LOW 23

The Woffice Core plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.4.21.

CVSS 3.1MEDIUM 5.4 Network No auth User interaction EPSS 0.00148 Published 2025-04-04 No fix listed CWE-352

TI-2024-28887 CVE-2024-43234 · GHSA-68gp-7m2f-pch3

WordPress Woffice theme <= 5.4.14 - Unauthenticated Account Takeover vulnerability

MEDIUM 50

Authentication Bypass Using an Alternate Path or Channel vulnerability in WofficeIO Woffice woffice allows Authentication Bypass.This issue affects Woffice: from n/a through <= 5.4.14.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00655 Published 2024-12-16 No fix listed CWE-288

TI-2024-24974 CVE-2024-37470 · GHSA-f57c-rm2w-7qmq

WordPress Woffice Core plugin <= 5.4.8 - Unauthenticated Broken Access Control vulnerability

MEDIUM 49

Missing Authorization vulnerability in WofficeIO Woffice Core allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Woffice Core: from n/a through 5.4.8.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00501 Published 2024-11-01 No fix listed CWE-862

TI-2024-07925 CVE-2024-8549 · GHSA-3hq4-wjf7-pw99

Simple Calendar – Google Calendar Plugin <= 3.4.2 - Reflected Cross-Site Scripting

LOW 28

The Simple Calendar – Google Calendar Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and includi…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00491 Published 2024-09-25 No fix listed CWE-79

TI-2024-28824 CVE-2024-43153 · GHSA-732m-w9mm-p8pc

WordPress Woffice theme <= 5.4.10 - Unauthenticated Privilege Escalation vulnerability

MEDIUM 44

Incorrect Privilege Assignment vulnerability in WofficeIO Woffice woffice.This issue affects Woffice: from n/a through <= 5.4.10.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00624 Published 2024-08-13 No fix listed CWE-266

TI-2024-24975 CVE-2024-37471 · GHSA-hx5r-m6gq-f3fp

WordPress Woffice Core plugin <= 5.4.8 - Site Wide Reflected Cross Site Scripting (XSS) vulnerability

LOW 31

Cross Site Scripting (XSS) vulnerability in WofficeIO Woffice Core allows Reflected XSS.This issue affects Woffice Core: from n/a through 5.4.8.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00288 Published 2024-07-04 No fix listed CWE-79

TI-2024-24976 CVE-2024-37472 · GHSA-j36g-v6mv-g3hp

WordPress Woffice theme <= 5.4.8 - Reflected Cross Site Scripting (XSS) vulnerability

LOW 31

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WofficeIO Woffice woffice.This issue affects Woffice: from n/a through <= 5.4.8.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.0033 Published 2024-07-04 No fix listed CWE-79

TI-2023-16004 CVE-2023-32738 · GHSA-mc6f-pv36-prr2

WordPress Eonet Manual User Approve Plugin <= 2.1.3 is vulnerable to Cross Site Scripting (XSS)

LOW 27

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Alkaweb Eonet Manual User Approve plugin <= 2.1.3 versions.

CVSS 3.1MEDIUM 5.9 Network High privileges User interaction EPSS 0.00369 Published 2023-10-27 No fix listed CWE-79

TI-2023-24816 CVE-2023-46189 · GHSA-qcp6-r6j2-hx5r

WordPress Google Calendar Events Plugin <= 3.2.5 is vulnerable to Cross Site Request Forgery (CSRF)

LOW 38

Cross-Site Request Forgery (CSRF) vulnerability in Simple Calendar – Google Calendar Plugin <= 3.2.5 versions.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00345 Published 2023-10-24 No fix listed CWE-352

Vulnerabilities

Filters