OOceanWP

Products

Exploited and recent CVEs

• CVE-2026-115592 High 7.1 WordPress OceanWP theme <= 4.2.7 - Cross Site Scripting (XSS) vulnerability 0.2%
• CVE-2026-86803 Medium 6.5 Ocean Extra <= 2.6.0 - Unauthenticated Arbitrary Shortcode Execution via 'oceanwp_library' Shortcode Template 0.2%
• CVE-2026-81929 High 7.2 Ocean Pro Demos <= 1.5.4 and Ocean eComm Treasure Box <= 1.8.0 - Unauthenticated Stored Cross-Site Scripting via 'content' Parameter 0.2%
• CVE-2026-81929 High 7.2 Ocean Pro Demos <= 1.5.4 and Ocean eComm Treasure Box <= 1.8.0 - Unauthenticated Stored Cross-Site Scripting via 'content' Parameter 0.2%
• CVE-2026-56007 Medium 5.9 WordPress Ocean Product Sharing plugin <= 2.2.2 - Cross Site Scripting (XSS) vulnerability 0.1%
• CVE-2026-34903 Medium 5.4 WordPress Ocean Extra plugin <= 2.5.3 - Broken Access Control vulnerability 0.3%
• CVE-2025-9499 Medium 6.4 Ocean Extra <= 2.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via oceanwp_library Shortcode 0.3%
• CVE-2025-8891 Medium 4.3 OceanWP <= 4.0.9 - 4.1.1 - Cross-Site Request Forgery to Ocean Extra Plugin Installation 0.2%
• CVE-2025-7500 Medium 6.4 Ocean Social Sharing <= 2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting 0.4%
• CVE-2024-5647 Medium 6.4 Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Magnific Popups JavaScript Library 0.4%
• CVE-2025-5524 Medium 4.9 OceanWP <= 4.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Select HTML Tag 0.3%
• CVE-2025-49068 Medium 6.5 WordPress Ocean Extra plugin <= 2.4.8 - Cross Site Scripting (XSS) vulnerability 0.2%
• CVE-2025-3458 Medium 6.4 Ocean Extra <= 2.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'ocean_gallery_id' 0.3%
• CVE-2025-3472 Medium 6.5 Ocean Extra <= 2.4.6 - Unauthenticated Arbitrary Shortcode Execution 2.0%
• CVE-2025-3457 Medium 6.4 Ocean Extra <= 2.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode 0.3%
• CVE-2024-37489 Medium 6.5 WordPress Ocean Extra plugin <= 2.2.9 - Authenticated Cross Site Scripting (XSS) vulnerability 0.3%
• CVE-2024-5531 Medium 6.4 Ocean Extra <= 2.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Flickr Widget 0.3%
• CVE-2023-23700 High 7.6 WordPress OceanWP theme <= 3.4.1 - Authenticated Local File Inclusion vulnerability 0.7%
• CVE-2024-3167 Medium 6.4 Ocean Extra <= 2.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting 0.5%
• CVE-2024-2476 Medium 4.3 OceanWP <= 3.5.4 - Missing Authorization to Sensitive Information Exposure via Limited Local File Inclusion 0.4%
• CVE-2024-1277 Medium 6.4 Ocean Extra <= 2.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting 0.5%
• CVE-2023-49164 Medium 5.4 WordPress Ocean Extra Plugin <= 2.2.2 is vulnerable to Cross Site Request Forgery (CSRF) 0.3%
• CVE-2020-36760 Medium 4.3 Ocean Extra <=1.6.5 - Cross-Site Request Forgery Bypass 0.6%
• CVE-2023-23891 Medium 5.5 WordPress Ocean Extra Plugin <= 2.1.1 is vulnerable to Cross Site Scripting (XSS) 0.3%
• CVE-2023-24399 Medium 5.5 WordPress Ocean Extra Plugin <= 2.1.2 is vulnerable to Cross Site Scripting (XSS) 0.3%