theme
14 known security issues reported for the Woffice WordPress theme. Most recent disclosed Jun 29, 2026.
Running Woffice on your site? Check whether your installed version is affected.
Scan your site freeThe Woffice CRM theme for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 5.4.32. This makes it possible for unauthenticated attackers to perform an unauthorized action.
[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WofficeIO Woffice woffice allows Reflected XSS.This issue affects Woffice: from n/a through <= 5.4.30.
The Woffice theme for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 5.4.30 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a...
The Woffice CRM theme for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.4.21. This is due to a misconfiguration of excluded roles during registration. This makes it possible for unauthenticated attackers to register with an Administrator role if a custom login form is being us...
[en] Authentication Bypass Using an Alternate Path or Channel vulnerability in WofficeIO Woffice allows Authentication Bypass.This issue affects Woffice: from n/a through 5.4.14.
The Woffice CRM theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 5.4.14. This makes it possible for unauthenticated attackers to gain access to administrator accounts.
[en] Improper Privilege Management vulnerability in WofficeIO Woffice allows Privilege Escalation.This issue affects Woffice: from n/a through 5.4.10.
The Woffice CRM theme for WordPress is vulnerable to privilege escalation in all versions up to, and including, 5.4.10. This makes it possible for unauthenticated attackers to gain access to accounts with administrative level access.
[en] Cross Site Scripting (XSS) vulnerability in WofficeIO Woffice allows Reflected XSS.This issue affects Woffice: from n/a through 5.4.8.
The Woffice theme for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘[function_or_param]’ parameter in versions up to, and including, 5.4.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that e...
The Woffice CRM theme for WordPress is vulnerable to authorization bypass due to a missing capability check on the wofficeNotificationGet function in versions up to, and including, 4.0.1. This makes it possible for unauthenticated attackers to view titles of notifications sent from user to user.
The Woffice CRM theme for WordPress is vulnerable to authorization bypass due to a missing capability check on the wofficeNotificationGet function in versions up to, and including, 4.0.1. This makes it possible for unauthenticated attackers to view titles of notifications sent from user to user.
The theme lacks authentication checks before returning the titles of notifications between the site's users.
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free