Oceanwp vulnerabilities

Products

• Ocean Extra 20
• Ocean Extra 14
• Oceanwp 7

Newest

• oceanwp WordPress OceanWP theme <= 4.2.7 - Cross Site Scripting (XSS) vulnerability CVE-2026-115592 7.1 HighOctober 29, 2026
• oceanwp ocean extra Ocean Extra <= 2.6.0 - Unauthenticated Arbitrary Shortcode Execution via 'oceanwp_library' Shortcode Template CVE-2026-86803 6.5 MediumOctober 15, 2026
• oceanwp ocean ecomm treasure box, ocean pro demos +1 more Ocean Pro Demos <= 1.5.4 and Ocean eComm Treasure Box <= 1.8.0 - Unauthenticated Stored Cross-Site Scripting via 'content' Parameter CVE-2026-81929 7.2 HighOctober 9, 2026
• oceanwp ocean product sharing WordPress Ocean Product Sharing plugin <= 2.2.2 - Cross Site Scripting (XSS) vulnerability CVE-2026-56007 5.9 MediumJune 18, 2026
• 100plugins open user map, 5starplugins dynamic copyright year, easy age verify +128 more +130 more Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter CVE-2024-13362 6.1 MediumMay 1, 2026
• oceanwp ocean extra WordPress Ocean Extra plugin <= 2.5.3 - Broken Access Control vulnerability CVE-2026-34903 5.4 MediumApril 7, 2026
• oceanwp OceanWP < 4.1.2 - Subscriber+ Limited Option Update CVE-2025-8944 4.3 MediumSeptember 5, 2025
• oceanwp ocean extra Ocean Extra <= 2.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via oceanwp_library Shortcode CVE-2025-9499 6.4 MediumAugust 30, 2025
• oceanwp OceanWP <= 4.0.9 - 4.1.1 - Cross-Site Request Forgery to Ocean Extra Plugin Installation CVE-2025-8891 4.3 MediumAugust 13, 2025
• oceanwp ocean social sharing Ocean Social Sharing <= 2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2025-7500 6.4 MediumAugust 2, 2025
• badhonrocks divi torque lite, blossomthemes social feed, boldthemes bold page builder +12 more +14 more Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Magnific Popups JavaScript Library CVE-2024-5647 6.4 MediumJuly 3, 2025
• oceanwp OceanWP <= 4.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Select HTML Tag CVE-2025-5524 4.9 MediumJune 19, 2025
• oceanwp ocean extra WordPress Ocean Extra plugin <= 2.4.8 - Cross Site Scripting (XSS) vulnerability CVE-2025-49068 6.5 MediumJune 6, 2025
• oceanwp ocean extra Ocean Extra <= 2.4.6 - Unauthenticated Arbitrary Shortcode Execution CVE-2025-3472 6.5 MediumApril 22, 2025
• oceanwp ocean extra Ocean Extra <= 2.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'ocean_gallery_id' CVE-2025-3458 6.4 MediumApril 22, 2025
• oceanwp ocean extra Ocean Extra <= 2.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode CVE-2025-3457 6.4 MediumApril 22, 2025
• 5starplugins easy age verify, featured images in rss for mailchimp & more, marijuana age verify +619 more +621 more Freemius SDK <= 2.4.2 - Missing Authorization Checks CVE-2022-4974 6.3 MediumOctober 16, 2024
• oceanwp ocean extra WordPress Ocean Extra plugin <= 2.2.9 - Authenticated Cross Site Scripting (XSS) vulnerability CVE-2024-37489 6.5 MediumJuly 21, 2024
• oceanwp ocean extra Ocean Extra <= 2.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Flickr Widget CVE-2024-5531 6.4 MediumJune 11, 2024
• oceanwp WordPress OceanWP theme <= 3.4.1 - Authenticated Local File Inclusion vulnerability CVE-2023-23700 7.6 HighMay 17, 2024
• oceanwp ocean extra Ocean Extra <= 2.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2024-3167 6.4 MediumApril 9, 2024
• oceanwp OceanWP <= 3.5.4 - Missing Authorization to Sensitive Information Exposure via Limited Local File Inclusion CVE-2024-2476 4.3 MediumMarch 29, 2024
• oceanwp ocean extra Ocean Extra <= 2.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2024-1277 6.4 MediumFebruary 20, 2024
• oceanwp ocean extra WordPress Ocean Extra Plugin <= 2.2.2 is vulnerable to Cross Site Request Forgery (CSRF) CVE-2023-49164 5.4 MediumDecember 19, 2023
• oceanwp ocean extra Ocean Extra <=1.6.5 - Cross-Site Request Forgery Bypass CVE-2020-36760 4.3 MediumJuly 12, 2023
• oceanwp ocean extra WordPress Ocean Extra Plugin <= 2.1.1 is vulnerable to Cross Site Scripting (XSS) CVE-2023-23891 5.5 MediumApril 6, 2023
• oceanwp ocean extra WordPress Ocean Extra Plugin <= 2.1.2 is vulnerable to Cross Site Scripting (XSS) CVE-2023-24399 5.5 MediumMarch 30, 2023
• oceanwp ocean extra Ocean Extra < 2.1.3 - Subscriber+ Arbitrary Post Content Disclosure CVE-2023-0749 6.5 MediumMarch 13, 2023
• oceanwp sticky header, oren hahiashvili oceanwp sticky header +1 more WordPress Oceanwp sticky header plugin <= 1.0.8 is vulnerable to Cross Site Request Forgery (CSRF) CVE-2022-35730 4.3 MediumDecember 4, 2022
• oceanwp ocean extra Ocean Extra < 2.0.5 - Admin+ PHP Objection Injection CVE-2022-3374 7.2 HighOctober 31, 2022
• oceanwp ocean extra Ocean Extra < 1.9.5 - Reflected Cross-Site Scripting CVE-2021-25104 6.1 MediumJune 20, 2022
• oceanwp ocean extra includes/wizard/wizard.php in the Ocean Extra plugin through 1.5.8 for WordPress allows... CVE-2019-16250 7.5 HighSeptember 11, 2019