OceanWP Ocean Extra

• CVE-2026-86803 Medium 6.5 Ocean Extra <= 2.6.0 - Unauthenticated Arbitrary Shortcode Execution via 'oceanwp_library' Shortcode Template 0.2%
• CVE-2026-34903 Medium 5.4 WordPress Ocean Extra plugin <= 2.5.3 - Broken Access Control vulnerability 0.3%
• CVE-2025-9499 Medium 6.4 Ocean Extra <= 2.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via oceanwp_library Shortcode 0.3%
• CVE-2025-49068 Medium 6.5 WordPress Ocean Extra plugin <= 2.4.8 - Cross Site Scripting (XSS) vulnerability 0.2%
• CVE-2025-3458 Medium 6.4 Ocean Extra <= 2.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'ocean_gallery_id' 0.3%
• CVE-2025-3472 Medium 6.5 Ocean Extra <= 2.4.6 - Unauthenticated Arbitrary Shortcode Execution 2.0%
• CVE-2025-3457 Medium 6.4 Ocean Extra <= 2.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode 0.3%
• CVE-2024-37489 Medium 6.5 WordPress Ocean Extra plugin <= 2.2.9 - Authenticated Cross Site Scripting (XSS) vulnerability 0.3%
• CVE-2024-5531 Medium 6.4 Ocean Extra <= 2.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Flickr Widget 0.3%
• CVE-2024-3167 Medium 6.4 Ocean Extra <= 2.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting 0.5%
• CVE-2024-1277 Medium 6.4 Ocean Extra <= 2.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting 0.5%
• CVE-2023-49164 Medium 5.4 WordPress Ocean Extra Plugin <= 2.2.2 is vulnerable to Cross Site Request Forgery (CSRF) 0.3%
• CVE-2020-36760 Medium 4.3 Ocean Extra <=1.6.5 - Cross-Site Request Forgery Bypass 0.6%
• CVE-2023-23891 Medium 5.5 WordPress Ocean Extra Plugin <= 2.1.1 is vulnerable to Cross Site Scripting (XSS) 0.3%
• CVE-2023-24399 Medium 5.5 WordPress Ocean Extra Plugin <= 2.1.2 is vulnerable to Cross Site Scripting (XSS) 0.3%