Skip to content
OpenAdvisories

Product · OceanWP

Ocean Extra

15 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

15 results · Clear filters · Feed

  • Medium 6.5
    CVE-2026-86803

    Ocean Extra <= 2.6.0 - Unauthenticated Arbitrary Shortcode Execution via 'oceanwp_library' Shortcode Template

    The The Ocean Extra plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.6.0 This is due to the software allowing users to execute an action that does not properly validate a value before running do_short…

    OceanWP Ocean Extra Web / CMS
  • Medium 5.4
    CVE-2026-34903

    WordPress Ocean Extra plugin <= 2.5.3 - Broken Access Control vulnerability

    Missing Authorization vulnerability in OceanWP Ocean Extra allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ocean Extra: from n/a through 2.5.3.

    OceanWP Ocean Extra
  • Medium 6.4
    CVE-2025-9499

    Ocean Extra <= 2.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via oceanwp_library Shortcode

    The Ocean Extra plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's oceanwp_library shortcode in all versions up to, and including, 2.4.9 due to insufficient input sanitization and output escaping on user supplied attributes. Th…

    OceanWP Ocean Extra Web / CMS
  • Medium 6.5
    CVE-2025-49068

    WordPress Ocean Extra plugin <= 2.4.8 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in oceanwp Ocean Extra ocean-extra allows Stored XSS.This issue affects Ocean Extra: from n/a through <= 2.4.8.

    OceanWP Ocean Extra
  • Medium 6.4
    CVE-2025-3458

    Ocean Extra <= 2.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'ocean_gallery_id'

    The Ocean Extra plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ocean_gallery_id’ parameter in all versions up to, and including, 2.4.6 due to insufficient input sanitization and output escaping. This makes it possible for authentic…

    OceanWP Ocean Extra Web / CMS
  • Medium 6.5
    CVE-2025-3472 Scanner template

    Ocean Extra <= 2.4.6 - Unauthenticated Arbitrary Shortcode Execution

    The Ocean Extra plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.4.6. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcod…

    OceanWP Ocean Extra Web / CMS
  • Medium 6.4
    CVE-2025-3457

    Ocean Extra <= 2.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

    The Ocean Extra plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'oceanwp_icon' shortcode in all versions up to, and including, 2.4.6 due to insufficient input sanitization and output escaping on user supplied attributes. Thi…

    OceanWP Ocean Extra Web / CMS
  • Medium 6.5
    CVE-2024-37489

    WordPress Ocean Extra plugin <= 2.2.9 - Authenticated Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in OceanWP Ocean Extra allows Stored XSS.This issue affects Ocean Extra: from n/a through 2.2.9.

    OceanWP Ocean Extra
  • Medium 6.4
    CVE-2024-5531

    Ocean Extra <= 2.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Flickr Widget

    The Ocean Extra plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Flickr widget in all versions up to, and including, 2.2.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible …

    OceanWP Ocean Extra Web / CMS
  • Medium 6.4
    CVE-2024-3167

    Ocean Extra <= 2.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting

    The Ocean Extra plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘twitter_username’ parameter in versions up to, and including, 2.2.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated…

    OceanWP Ocean Extra Web / CMS
  • Medium 6.4
    CVE-2024-1277

    Ocean Extra <= 2.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting

    The Ocean Extra plugin for WordPress is vulnerable to Stored Cross-Site Scripting via custom fields in all versions up to, and including, 2.2.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, wit…

    OceanWP Ocean Extra Web / CMS
  • Medium 5.4
    CVE-2023-49164

    WordPress Ocean Extra Plugin <= 2.2.2 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in OceanWP Ocean Extra.This issue affects Ocean Extra: from n/a through 2.2.2.

    OceanWP Ocean Extra
  • Medium 4.3
    CVE-2020-36760

    Ocean Extra <=1.6.5 - Cross-Site Request Forgery Bypass

    The Ocean Extra plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.6.5]. This is due to missing or incorrect nonce validation on the add_core_extensions_bundle_validation() function. This makes it possible for…

    OceanWP Ocean Extra Web / CMS
  • Medium 5.5
    CVE-2023-23891

    WordPress Ocean Extra Plugin <= 2.1.1 is vulnerable to Cross Site Scripting (XSS)

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in OceanWP Ocean Extra plugin <= 2.1.1 versions. Needs the OceanWP theme installed and activated.

    OceanWP Ocean Extra
  • Medium 5.5
    CVE-2023-24399

    WordPress Ocean Extra Plugin <= 2.1.2 is vulnerable to Cross Site Scripting (XSS)

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in OceanWP Ocean Extra plugin <= 2.1.2 versions.

    OceanWP Ocean Extra