Ocean Extra vulnerabilities | LiveThreat CVE Feed — Verisq

Login Request a demo

OE

Product

Ocean Extra

by oceanwp · last CVE Oct 15, 2026

19

CVEs

0

On KEV

9.8

Max CVSS

1

New 30D

Vulnerabilities19 In the news0 Timeline

Severity mix

Critical 1High 3Medium 15Low 0

Severity

All severities19 Critical1 High3 Medium15 Low0

Exploitation

On CISA KEV0 Exploited in the wild0

Watch

Add Ocean Extra to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2026-86803	6.5	0%	Oct 15	Ocean Extra <= 2.6.0 - Unauthenticated Arbitrary Shortcode Execution via 'oceanwp_library' Shortcode Template Affected: through 2.6.0
CVE-2025-49068	6.5	0%	Jun 6	WordPress Ocean Extra plugin <= 2.4.8 - Cross Site Scripting (XSS) vulnerability Affected: through 2.4.8
CVE-2023-0749	6.5	1%	Mar 13	The Ocean Extra WordPress plugin before 2.1.3 does not ensure that the template to be loaded via a shortcode is actually a template, allowing any authenticated users such as… Affected: before 2.1.3
CVE-2025-9499	6.4	0%	Aug 30	Ocean Extra <= 2.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via oceanwp_library Shortcode Affected: through 2.4.9
CVE-2024-5531	6.4	0%	Jun 11	Ocean Extra <= 2.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Flickr Widget Affected: through 2.2.8
CVE-2024-3167	6.4	1%	Apr 9	Ocean Extra <= 2.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting Affected: through 2.2.6
CVE-2021-25104	6.1	1%	Jun 20	The Ocean Extra WordPress plugin before 1.9.5 does not escape generated links which are then used when the OceanWP is active, leading to a Reflected Cross-Site Scripting issue Affected: before 1.9.5
CVE-2026-34903	5.4	0%	Apr 7	WordPress Ocean Extra plugin <= 2.5.3 - Broken Access Control vulnerability Affected: through 2.5.3
CVE-2025-3458	5.4	0%	Apr 22	Ocean Extra <= 2.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'ocean_gallery_id' Affected: through 2.4.6
CVE-2025-3457	5.4	0%	Apr 22	Ocean Extra <= 2.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Affected: through 2.4.6
CVE-2024-37489	5.4	0%	Jul 21	WordPress Ocean Extra plugin <= 2.2.9 - Authenticated Cross Site Scripting (XSS) vulnerability Affected: through 2.2.9
CVE-2024-1277	5.4	0%	Feb 20	Ocean Extra <= 2.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting Affected: through 2.2.4
CVE-2023-23891	5.4	0%	Apr 6	Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in OceanWP Ocean Extra plugin <= 2.1.1 versions. Needs the OceanWP theme installed and activated Affected: before 2.1.2
CVE-2023-24399	5.4	0%	Mar 30	Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in OceanWP Ocean Extra plugin <= 2.1.2 versions Affected: before 2.1.3
CVE-2020-36760	4.3	1%	Jul 12	The Ocean Extra plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.6.5] Affected: through 1.6.5