| CVE-2026-86803 |
The The Ocean Extra plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and…
|
6.5
Medium
|
Oct 15, 2026 |
| CVE-2026-94684 |
Contributor Cross Site Scripting (XSS) in Ocean Extra <= 2.6.1 versions
|
6.5
Medium
|
Sep 23, 2026 |
| CVE-2024-13362 |
Multiple plugins and/or themes for WordPress are vulnerable to Reflected Cross-Site Scripting via the url parameter in…
|
6.1
Medium
|
May 1, 2026 |
| CVE-2026-34903 |
Missing Authorization vulnerability in OceanWP Ocean Extra allows Exploiting Incorrectly Configured Access Control…
|
5.4
Medium
|
Apr 7, 2026 |
| CVE-2025-9499 |
The Ocean Extra plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's oceanwp_library…
|
6.4
Medium
|
Aug 30, 2025 |
| CVE-2025-49068 |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in oceanwp Ocean…
|
6.5
Medium
|
Jun 6, 2025 |
| CVE-2025-3458 |
The Ocean Extra plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ocean_gallery_id’ parameter…
|
6.4
Medium
|
Apr 22, 2025 |
| CVE-2025-3472 |
The Ocean Extra plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and…
|
6.5
Medium
|
Apr 22, 2025 |
| CVE-2025-3457 |
The Ocean Extra plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'oceanwp_icon'…
|
6.4
Medium
|
Apr 22, 2025 |
| CVE-2022-4974 |
The Freemius SDK, as used by hundreds of WordPress plugin and theme developers, was vulnerable to Cross-Site Request…
|
6.3
Medium
|
Oct 16, 2024 |
| CVE-2024-37489 |
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in OceanWP…
|
6.5
Medium
|
Jul 21, 2024 |
| CVE-2024-5531 |
The Ocean Extra plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Flickr widget in all…
|
6.4
Medium
|
Jun 11, 2024 |
| CVE-2024-3167 |
The Ocean Extra plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘twitter_username’ parameter…
|
6.4
Medium
|
Apr 9, 2024 |
| CVE-2024-1277 |
The Ocean Extra plugin for WordPress is vulnerable to Stored Cross-Site Scripting via custom fields in all versions up…
|
6.4
Medium
|
Feb 20, 2024 |
| CVE-2023-49164 |
Cross-Site Request Forgery (CSRF) vulnerability in OceanWP Ocean Extra.This issue affects Ocean Extra: from n/a…
|
5.4
Medium
|
Dec 19, 2023 |
| CVE-2020-36760 |
The Ocean Extra plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including,…
|
4.3
Medium
|
Jul 12, 2023 |