Xtendify

12 CVEs across 4 Xtendify products. Browse Xtendify vulnerabilities, severities, and proof-of-concept exploits.

Xtendify products with known CVEs

Product	CVEs
Woffice	9
Simple Calendar	2
Eonet Manual User Approve	1
Woffice Crm	1

Xtendify CVEs — newest first
CVE	Severity	Score	Published	Summary
`CVE-2025-7694`	Medium	`6.8`	2025-08-02	The Woffice Core plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the woffice_file_manager_delete() fu…
`CVE-2025-2798`	Critical	`9.8`	2025-04-04	The Woffice CRM theme for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.4.21. This is due to a misconfiguration of e…
`CVE-2025-2797`	Medium	`5.4`	2025-04-04	The Woffice Core plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.4.21. This is due to missing or incor…
`CVE-2025-2780`	High	`8.8`	2025-04-04	The Woffice Core plugin for WordPress, used by the Woffice Theme, is vulnerable to arbitrary file uploads due to missing file type validation in the 'saveFeatu…
`CVE-2024-43234`	Critical	`9.8`	2024-12-16	Authentication Bypass Using an Alternate Path or Channel vulnerability in WofficeIO Woffice woffice allows Authentication Bypass.This issue affects Woffice: fr…
`CVE-2024-37470`	High	`8.2`	2024-11-01	Missing Authorization vulnerability in WofficeIO Woffice Core allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Woffice Core…
`CVE-2024-8549`	Medium	`6.1`	2024-09-25	The Simple Calendar – Google Calendar Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appro…
`CVE-2024-43153`	Critical	`9.8`	2024-08-13	Incorrect Privilege Assignment vulnerability in WofficeIO Woffice woffice.This issue affects Woffice: from n/a through <= 5.4.10.
`CVE-2024-37472`	High	`7.1`	2024-07-04	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WofficeIO Woffice woffice.This issue affects Woffice: fro…
`CVE-2024-37471`	High	`7.1`	2024-07-04	Cross Site Scripting (XSS) vulnerability in WofficeIO Woffice Core allows Reflected XSS.This issue affects Woffice Core: from n/a through 5.4.8.
`CVE-2023-32738`	Medium	`5.9`	2023-10-27	Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Alkaweb Eonet Manual User Approve plugin <= 2.1.3 versions.
`CVE-2023-46189`	Medium	`4.3`	2023-10-25	Cross-Site Request Forgery (CSRF) vulnerability in Simple Calendar – Google Calendar Plugin <= 3.2.5 versions.