Advisories · Technology

Woffice.

Every CVE that names Woffice among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-39747 CVE record

CVSS 8.5 High

WordPress Woffice theme < 5.4.43 - SQL Injection vulnerability
- Woffice
- SQL injection
Not analysed yet 6 Oct 2026
CVE-2026-27435 CVE record

CVSS 5.3 Medium

WordPress Woffice theme < 5.4.33 - Broken Access Control vulnerability
- Woffice
- Broken access control
Not analysed yet 1 Jul 2026
CVE-2025-67918 CVE record

CVSS 7.1 High

WordPress Woffice theme <= 5.4.30 - Cross Site Scripting (XSS) vulnerability
- Woffice
- Cross-site scripting (XSS)
Not analysed yet 8 Jan 2026
CVE-2024-43234 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

WordPress Woffice theme <= 5.4.14 - Unauthenticated Account Takeover vulnerability
- Woffice
- Authentication bypass
Not analysed yet 16 Dec 2024
CVE-2024-43153 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

WordPress Woffice theme <= 5.4.10 - Unauthenticated Privilege Escalation vulnerability
- Woffice
- Privilege escalation
Not analysed yet 13 Aug 2024
CVE-2024-37472 CVE record

CVSS 7.1 High

WordPress Woffice theme <= 5.4.8 - Reflected Cross Site Scripting (XSS) vulnerability
- Woffice
- Cross-site scripting (XSS)
Not analysed yet 4 Jul 2024