Login Request a demo
OE
Product
Ocean Extra
by oceanwp · last CVE Oct 15, 2026
19
CVEs
0
On KEV
9.8
Max CVSS
1
New 30D
Vulnerabilities19In the news0Timeline
Severity mix
Critical 1High 3Medium 15Low 0
Severity
All severities19Critical1High3Medium15Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add Ocean Extra to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2025-3472
9.8
2%
Apr 22
Ocean Extra <= 2.4.6 - Unauthenticated Arbitrary Shortcode Execution
Affected: through 2.4.6
CVE-2023-49164
8.8
0%
Dec 19
Cross-Site Request Forgery (CSRF) vulnerability in OceanWP Ocean Extra.This issue affects Ocean Extra: from n/a through 2.2.2
Affected: before 2.2.3
CVE-2019-16250
7.5
1%
Sep 11
includes/wizard/wizard.php in the Ocean Extra plugin through 1.5.8 for WordPress allows unauthenticated options changes and injection of a Cascading Style Sheets (CSS) token…
Affected: through 1.5.8
CVE-2022-3374
7.2
2%
Oct 31
Ocean Extra < 2.0.5 - Admin+ PHP Objection Injection
Affected: before 2.0.5
CVE-2026-86803
6.5
0%
Oct 15
Ocean Extra <= 2.6.0 - Unauthenticated Arbitrary Shortcode Execution via 'oceanwp_library' Shortcode Template
Affected: through 2.6.0
CVE-2025-49068
6.5
0%
Jun 6
WordPress Ocean Extra plugin <= 2.4.8 - Cross Site Scripting (XSS) vulnerability
Affected: through 2.4.8
CVE-2023-0749
6.5
1%
Mar 13
The Ocean Extra WordPress plugin before 2.1.3 does not ensure that the template to be loaded via a shortcode is actually a template, allowing any authenticated users such as…
Affected: before 2.1.3
CVE-2025-9499
6.4
0%
Aug 30
Ocean Extra <= 2.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via oceanwp_library Shortcode
Affected: through 2.4.9
CVE-2024-5531
6.4
0%
Jun 11
Ocean Extra <= 2.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Flickr Widget
Affected: through 2.2.8
CVE-2024-3167
6.4
1%
Apr 9
Ocean Extra <= 2.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
Affected: through 2.2.6
CVE-2021-25104
6.1
1%
Jun 20
The Ocean Extra WordPress plugin before 1.9.5 does not escape generated links which are then used when the OceanWP is active, leading to a Reflected Cross-Site Scripting issue
Affected: before 1.9.5
CVE-2026-34903
5.4
0%
Apr 7
WordPress Ocean Extra plugin <= 2.5.3 - Broken Access Control vulnerability
Affected: through 2.5.3
CVE-2025-3458
5.4
0%
Apr 22
Ocean Extra <= 2.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'ocean_gallery_id'
Affected: through 2.4.6
CVE-2025-3457
5.4
0%
Apr 22
Ocean Extra <= 2.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Affected: through 2.4.6
CVE-2024-37489
5.4
0%
Jul 21
WordPress Ocean Extra plugin <= 2.2.9 - Authenticated Cross Site Scripting (XSS) vulnerability
Affected: through 2.2.9
CVE-2024-1277
5.4
0%
Feb 20
Ocean Extra <= 2.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
Affected: through 2.2.4
CVE-2023-23891
5.4
0%
Apr 6
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in OceanWP Ocean Extra plugin <= 2.1.1 versions. Needs the OceanWP theme installed and activated
Affected: before 2.1.2
CVE-2023-24399
5.4
0%
Mar 30
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in OceanWP Ocean Extra plugin <= 2.1.2 versions
Affected: before 2.1.3
CVE-2020-36760
4.3
1%
Jul 12
The Ocean Extra plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.6.5]
Affected: through 1.6.5
Showing 19