How many xtendify woffice CVEs are in CISA KEV?

None of xtendify woffice's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.

Which versions of xtendify woffice are affected?

10 distinct xtendify woffice versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.

What are the most common weakness types in xtendify woffice CVEs?

xtendify woffice's CVEs most often map to these CWE weakness types: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')), CWE-266 (Incorrect Privilege Assignment), CWE-269 (Improper Privilege Management), CWE-288 (Authentication Bypass Using an Alternate Path or Channel).

How many critical xtendify woffice vulnerabilities are there?

xtendify woffice has 4 critical and 4 high-severity CVEs.

What is the average severity of xtendify woffice CVEs?

The average CVSS base score across xtendify woffice's scored CVEs is 8.3.

RadicalNotion.AI

Log in Start free

Log in

Log in Start free

xtendify

9 CVEs

xtendify woffice Vulnerabilities

Name: xtendify woffice vulnerability dataset (CVEs)
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

CVE security advisories and vulnerability history for woffice by xtendify.

9

Total CVEs

Published

0

In CISA KEV

Exploited in the wild

0

Public exploits

PoC or exploit code

8.3

Avg CVSS

2024–2025

Last updated August 2, 2025

Overview

xtendify woffice has 9 published CVE records since 2024, of which 0 are in CISA's Known Exploited Vulnerabilities catalog and 0 have a known public exploit. The average CVSS base score across scored CVEs is 8.3.

This page aggregates every publicly disclosed vulnerability (CVE) affecting xtendify woffice, with a severity breakdown, the affected and patched versions, the most common weakness types, and the full CVE list.

Severity and exploitation

How the CVSS severity of xtendify woffice's CVEs breaks down, plus how many are exploited in the wild or have public exploit code.

Critical4

High4

Medium1

Low0

In CISA’s Known Exploited Vulnerabilities catalog

0

None of xtendify woffice's CVEs are currently listed in CISA's KEV catalog.

Public exploits

0

No xtendify woffice CVEs currently have a tracked public exploit.

Affected versions and CVEs

Browse every xtendify woffice version named in a CVE, then pick one to see only the CVEs that affect it.

Version ranges

< 5.4.223 CVEs
< 5.4.93 CVEs
< 5.4.121 CVE
< 5.4.151 CVE
< 5.4.271 CVE

Fixed in

5.4.223 CVEs
5.4.93 CVEs
5.4.121 CVE
5.4.151 CVE
5.4.271 CVE

Find a version

9 CVEs

Sort

Woffice Core <= 5.4.26 - Authenticated (Contributor+) Arbitrary File Deletion
CVE-2025-7694
Patch
CWE-22
High · CVSS 7.5
EPSS 0.9% (55th pct)2025-08-02
Woffice <= 5.4.21 - Authentication Bypass via Registration Role
CVE-2025-2798
Patch
CWE-269
Critical · CVSS 9.8
EPSS 0.6% (46th pct)2025-04-04
Woffice Core <= 5.4.21 - Authenticated (Subscriber+) Arbitrary File Upload
CVE-2025-2780
Patch
CWE-434
High · CVSS 8.8
EPSS 0.8% (52th pct)2025-04-04
Woffice Core <= 5.4.21 - Cross-Site Request Forgery to User Registration Approval
CVE-2025-2797
Patch
CWE-352
Medium · CVSS 5.4
EPSS 0.1% (4th pct)2025-04-04
WordPress Woffice theme <= 5.4.14 - Unauthenticated Account Takeover vulnerability
CVE-2024-43234
Patch
CWE-288
Critical · CVSS 9.8
EPSS 0.7% (48th pct)2024-12-16
WordPress Woffice Core plugin <= 5.4.8 - Unauthenticated Broken Access Control vulnerability
CVE-2024-37470
Patch
CWE-862
Critical · CVSS 9.8
EPSS 0.5% (39th pct)2024-11-01
WordPress Woffice theme <= 5.4.10 - Unauthenticated Privilege Escalation vulnerability
CVE-2024-43153
Patch
CWE-266
Critical · CVSS 9.8
EPSS 0.6% (46th pct)2024-08-13
WordPress Woffice Core plugin <= 5.4.8 - Site Wide Reflected Cross Site Scripting (XSS) vulnerability
CVE-2024-37471
Patch
CWE-79
High · CVSS 7.1
EPSS 0.3% (21th pct)2024-07-04
WordPress Woffice theme <= 5.4.8 - Reflected Cross Site Scripting (XSS) vulnerability
CVE-2024-37472
Patch
CWE-79
High · CVSS 7.1
EPSS 0.3% (26th pct)2024-07-04

Common weakness types

The CWE weakness categories most often found in xtendify woffice CVEs. Follow any weakness for its full explanation.

Disclosure activity by year

How many xtendify woffice CVEs were published each year.

2024

5

2025

4

Other xtendify products

Browse vulnerabilities for other products by xtendify.

simple calendar2 CVEs eonet manual user approve1 CVEs Woffice CRM1 CVEs

All xtendify vulnerabilities

Frequently asked questions

Common questions about xtendify woffice vulnerabilities.

How many CVEs does xtendify woffice have?: xtendify woffice has 9 published CVE records since 2024.
How many xtendify woffice CVEs are in CISA KEV?: None of xtendify woffice's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.
Are there public exploits for xtendify woffice vulnerabilities?: No xtendify woffice CVEs currently have a tracked public exploit in this dataset.
Which versions of xtendify woffice are affected?: 10 distinct xtendify woffice versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.
What are the most common weakness types in xtendify woffice CVEs?: xtendify woffice's CVEs most often map to these CWE weakness types: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')), CWE-266 (Incorrect Privilege Assignment), CWE-269 (Improper Privilege Management), CWE-288 (Authentication Bypass Using an Alternate Path or Channel).
How many critical xtendify woffice vulnerabilities are there?: xtendify woffice has 4 critical and 4 high-severity CVEs.
What is the average severity of xtendify woffice CVEs?: The average CVSS base score across xtendify woffice's scored CVEs is 8.3.

References

Vulnerability data is sourced from the CVE Program; severity, KEV, and exploit signals are aggregated by RadicalNotion.AI.

Track xtendify woffice vulnerabilities

Monitor new xtendify woffice vulnerabilities as they are disclosed, with AI-written analysis and remediation guidance.

Start free See pricing