Improper Neutralization of Input During Web Page Generation allows an attacker to inject malicious scripts into pages served by the affected WordPress theme. The reflected XSS flaw can execute arbitrary code within the context of a victim’s browser, potentially compromising session data, defacing content, or facilitating phishing attacks. The weakness is identified as CWE‑79, reflecting the reliance on untrusted user input without proper output encoding.

WofficeIO’s Woffice theme for WordPress is vulnerable in all versions from the initial release through 5.4.30. Any site utilizing the theme in these versions is impacted and should be considered for remediation.

The CVSS score of 7.1 indicates a moderate severity, and the EPSS score of less than 1% suggests a low probability of exploitation at present. However, the vulnerability is present in all legacy theme versions and is not listed in the CISA KEV catalog. An attacker can likely exploit the flaw via a crafted URL that includes malicious user input, leading to reflected XSS in the victim’s browser. While exploitation potential is moderate, the widespread use of the theme warrants timely patching.