Login Request a demo
OC
Vendor
oceanwp
7 products with CVEs on record
31
CVEs
0
On KEV
4
New 30D
Products
OE
Ocean Extra
oceanwp
9.8
19 CVEs0 on KEV1 new
OC
OceanWP
oceanwp
7.6
7 CVEs0 on KEV1 new
OE
Ocean eComm Treasure Box
OceanWP
7.2
1 CVEs0 on KEV1 new
OP
Ocean Pro Demos
OceanWP
7.2
1 CVEs0 on KEV1 new
OP
Ocean Product Sharing
OceanWP
5.9
1 CVEs0 on KEV0 new
OS
Ocean Social Sharing
oceanwp
6.4
1 CVEs0 on KEV0 new
SH
Sticky Header
Oceanwp
6.5
1 CVEs0 on KEV0 new
Recent CVEs
CVEProductCVSSEPSSPublishedSummary
CVE-2026-115592
New
OC
OceanWP
OceanWP
7.1–Oct 29WordPress OceanWP theme <= 4.2.7 - Cross Site Scripting (XSS) vulnerability
CVE-2026-86803
OE
Ocean Extra
oceanwp
6.5
0%
Oct 15Ocean Extra <= 2.6.0 - Unauthenticated Arbitrary Shortcode Execution via 'oceanwp_library' Shortcode Template
CVE-2026-81929
OP
Ocean Pro Demos
OceanWP
7.2
0%
Oct 9Ocean Pro Demos <= 1.5.4 and Ocean eComm Treasure Box <= 1.8.0 - Unauthenticated Stored Cross-Site Scripting via 'content' Parameter
CVE-2026-56007
OP
Ocean Product Sharing
OceanWP
5.9
0%
Jun 18WordPress Ocean Product Sharing plugin <= 2.2.2 - Cross Site Scripting (XSS) vulnerability
CVE-2026-34903
OE
Ocean Extra
OceanWP
5.4
0%
Apr 7WordPress Ocean Extra plugin <= 2.5.3 - Broken Access Control vulnerability
CVE-2025-8944
OC
Oceanwp
Oceanwp
4.3
0%
Sep 5OceanWP < 4.1.2 - Subscriber+ Limited Option Update
CVE-2025-9499
OE
Ocean Extra
oceanwp
6.4
0%
Aug 30Ocean Extra <= 2.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via oceanwp_library Shortcode
CVE-2025-8891
OC
OceanWP
oceanwp
4.3
0%
Aug 13OceanWP <= 4.0.9 - 4.1.1 - Cross-Site Request Forgery to Ocean Extra Plugin Installation
CVE-2025-7500
OS
Ocean Social Sharing
oceanwp
6.4
0%
Aug 2Ocean Social Sharing <= 2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
CVE-2024-5647
OC
OceanWP
oceanwp
6.4
0%
Jul 3Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Magnific Popups JavaScript Library
CVE-2025-5524
OC
OceanWP
oceanwp
4.9
0%
Jun 19OceanWP <= 4.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Select HTML Tag
CVE-2025-49068
OE
Ocean Extra
oceanwp
6.5
0%
Jun 6WordPress Ocean Extra plugin <= 2.4.8 - Cross Site Scripting (XSS) vulnerability
CVE-2025-3458
OE
Ocean Extra
oceanwp
5.4
0%
Apr 22Ocean Extra <= 2.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'ocean_gallery_id'
CVE-2025-3472
OE
Ocean Extra
oceanwp
9.8
2%
Apr 22Ocean Extra <= 2.4.6 - Unauthenticated Arbitrary Shortcode Execution
CVE-2025-3457
OE
Ocean Extra
oceanwp
5.4
0%
Apr 22Ocean Extra <= 2.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
CVE-2024-37489
OE
Ocean Extra
OceanWP
5.4
0%
Jul 21WordPress Ocean Extra plugin <= 2.2.9 - Authenticated Cross Site Scripting (XSS) vulnerability
CVE-2024-5531
OE
Ocean Extra
oceanwp
6.4
0%
Jun 11Ocean Extra <= 2.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Flickr Widget
CVE-2023-23700
OC
OceanWP
OceanWP
7.6
1%
May 17WordPress OceanWP theme <= 3.4.1 - Authenticated Local File Inclusion vulnerability
CVE-2024-3167
OE
Ocean Extra
oceanwp
6.4
1%
Apr 9Ocean Extra <= 2.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
CVE-2024-2476
OC
OceanWP
oceanwp
4.3
0%
Mar 29OceanWP <= 3.5.4 - Missing Authorization to Sensitive Information Exposure via Limited Local File Inclusion
CVE-2024-1277
OE
Ocean Extra
Oceanwp
5.4
0%
Feb 29The Ocean Extra plugin for WordPress is vulnerable to Stored Cross-Site Scripting via custom fields in all versions up to, and including, 2.2.4 due to insufficient input…
CVE-2023-49164
OE
Ocean Extra
Oceanwp
8.8
0%
Dec 19Cross-Site Request Forgery (CSRF) vulnerability in OceanWP Ocean Extra.This issue affects Ocean Extra: from n/a through 2.2.2
CVE-2020-36760
OE
Ocean Extra
Oceanwp
4.3
1%
Jul 12The Ocean Extra plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.6.5]
CVE-2023-23891
OE
Ocean Extra
Oceanwp
5.4
0%
Apr 6Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in OceanWP Ocean Extra plugin <= 2.1.1 versions. Needs the OceanWP theme installed and activated
CVE-2023-24399
OE
Ocean Extra
Oceanwp
5.4
0%
Mar 30Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in OceanWP Ocean Extra plugin <= 2.1.2 versions
CVE-2023-0749
OE
Ocean Extra
Oceanwp
6.5
1%
Mar 13The Ocean Extra WordPress plugin before 2.1.3 does not ensure that the template to be loaded via a shortcode is actually a template, allowing any authenticated users such as…
CVE-2022-35730
SH
Sticky Header
Oceanwp
6.5
0%
Dec 4Cross-Site Request Forgery (CSRF) vulnerability in Oceanwp sticky header plugin <= 1.0.8 on WordPress
CVE-2022-3374
OE
Ocean Extra
Oceanwp
7.2
2%
Oct 31Ocean Extra < 2.0.5 - Admin+ PHP Objection Injection
CVE-2021-25104
OE
Ocean Extra
Oceanwp
6.1
1%
Jun 20The Ocean Extra WordPress plugin before 1.9.5 does not escape generated links which are then used when the OceanWP is active, leading to a Reflected Cross-Site Scripting issue
CVE-2019-16250
OE
Ocean Extra
Oceanwp
7.5
1%
Sep 11includes/wizard/wizard.php in the Ocean Extra plugin through 1.5.8 for WordPress allows unauthenticated options changes and injection of a Cascading Style Sheets (CSS) token…