Wps Office
Vendor:
First CVE: Jul 18, 2018 · Active for 8 years
10
Total CVEs
More Total CVEs than 89% of tracked products
1.7
Avg CVEs / Year
Higher CVE frequency than 62% of tracked products
7.4
Avg CVSS
Higher Avg CVSS than 51% of tracked products
10.0%
KEV Rate
Higher KEV Rate than 98% of tracked products
Trends Over Time
The number and severity of CVEs published that impact Wps Office over time
Volume of CVEsAvg CVSS Base Score
First CVE
Jul 18, 2018
8 years ago
Most Recent CVE
May 14, 2025
439 days ago
CVE Severity & Scoring
Wps Office10 CVEs
20%
80%
All CVEs352,785 CVEs
45%
40%
11%
MediumHigh
Attack Vector
Local9 (90.0%)
Network1 (10.0%)
Unknown0 (0.0%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low9 (90.0%)
High1 (10.0%)
Unknown0 (0.0%)
User Interaction
None3 (30.0%)
Unknown0 (0.0%)
Required7 (70.0%)
Privileges Required
Low2 (20.0%)
High0 (0.0%)
None8 (80.0%)
Unknown0 (0.0%)
Top CVEs
Signals from CVEs in this product scope (10 CVEs).
10 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2024-7262HIGH Improper path validation in promecefpluginhost.exe in Kingsoft WPS Office version ranging from 12.2.0.13110 to 12.2.0.16412 (exclusive) on Windows allows an attacker to load an arb | Aug 15, 2024 | 7.8 | 65 | YES | NO |
CVE-2024-7263HIGH Improper path validation in promecefpluginhost.exe in Kingsoft WPS Office version ranging from 12.2.0.13110 to 12.2.0.17115 (exclusive) on Windows allows an attacker to load an arb | Aug 15, 2024 | 7.8 | 26 | NO | NO |
CVE-2022-26081HIGH The installer of WPS Office Version 10.8.0.5745 insecurely load shcore.dll, allowing an attacker to execute arbitrary code with the privilege of the user invoking the installer. | Mar 17, 2022 | 7.8 | 25 | NO | NO |
CVE-2022-25943HIGH The installer of WPS Office for Windows versions prior to v11.2.0.10258 fails to configure properly the ACL for the directory where the service program is installed. | Mar 9, 2022 | 7.8 | 25 | NO | NO |
CVE-2020-25291HIGH GdiDrawHoriLineIAlt in Kingsoft WPS Office before 11.2.0.9403 allows remote heap corruption via a crafted PLTE chunk in PNG data within a Word document. This is related to QBrush:: | Sep 13, 2020 | 7.8 | 25 | NO | NO |
CVE-2022-25969HIGH The installer of WPS Office Version 10.8.0.6186 insecurely load VERSION.DLL (or some other DLLs), allowing an attacker to execute arbitrary code with the privilege of the user invo | Mar 17, 2022 | 7.8 | 24 | NO | NO |
CVE-2023-31275HIGH An uninitialized pointer use vulnerability exists in the functionality of WPS Office 11.2.0.11537 that handles Data elements in an Excel file. A specially crafted malformed file ca | Nov 27, 2023 | 7.8 | 23 | NO | NO |
CVE-2023-32548HIGH OS command injection vulnerability exists in WPS Office version 10.8.0.6186. If a remote attacker who can conduct a man-in-the-middle attack connects the product to a malicious ser | Jun 13, 2023 | 8.1 | 23 | NO | NO |
CVE-2018-7546MEDIUM wpsmain.dll in Kingsoft WPS Office 2016 and Jinshan PDF 10.1.0.6621 allows remote attackers to cause a denial of service via a crafted pdf file. | Jul 18, 2018 | 5.5 | 19 | NO | NO |
CVE-2024-57096MEDIUM An issue in wps office before v.19302 allows a local attacker to obtain sensitive information via a crafted file. | May 14, 2025 | 5.5 | 17 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (10 CVEs).
CISA KEV
1 CVE
10.0% of CVEs· 98th percentile
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
0 CVEs
0.0% of CVEs· Bottom 1%
Social Chatter
Signals from CVEs in this product scope (10 CVEs).
Media Mentions
Signals from CVEs in this product scope (10 CVEs).
Top CNAs Publishing CVEs For Wps Office
Top CWEs
Versions
| Version | CVE Count | Avg CVSS | Avg EPSS | KEV | Exploits |
|---|---|---|---|---|---|
| 2016 | 1 | 5.5 | 1.4% | 0 | 0 |
| 11.2.0.11537 | 1 | 7.8 | 1.7% | 0 | 0 |
| 10.8.0.6186 | 2 | 8.0 | 0.9% | 0 | 0 |
| 10.8.0.5745 | 1 | 7.8 | 0.8% | 0 | 0 |