What’s Vulnerable › Products
oceanwp Ocean Extra vulnerabilities
21 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 8 published in the last 12 months.
Check whether your oceanwp Ocean Extra version is affected
Latest oceanwp Ocean Extra vulnerabilities
- CVE-2026-86803 — Ocean Extra <= 2.6.0 - Unauthenticated Arbitrary Shortcode Execution via 'oceanwp_library' Shortcode Template (CVSS 6.5)
- CVE-2024-13362 — Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter (CVSS 6.1)
- CVE-2026-34903 — WordPress Ocean Extra plugin <= 2.5.3 - Broken Access Control vulnerability (CVSS 5.4)
- CVE-2025-9499 — Ocean Extra <= 2.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via oceanwp_library Shortcode (CVSS 6.4)
- CVE-2025-49068 — WordPress Ocean Extra plugin <= 2.4.8 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- CVE-2025-3472 — Ocean Extra <= 2.4.6 - Unauthenticated Arbitrary Shortcode Execution (CVSS 9.8)
- CVE-2025-3458 — Ocean Extra <= 2.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'ocean_gallery_id' (CVSS 5.4)
- CVE-2025-3457 — Ocean Extra <= 2.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 5.4)
- CVE-2022-4974 — Freemius SDK <= 2.4.2 - Missing Authorization Checks (CVSS 6.3)
- CVE-2024-37489 — WordPress Ocean Extra plugin <= 2.2.9 - Authenticated Cross Site Scripting (XSS) vulnerability (CVSS 5.4)
- CVE-2024-5531 — Ocean Extra <= 2.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Flickr Widget (CVSS 6.4)
- CVE-2024-3167 — Ocean Extra <= 2.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4)
- CVE-2024-1277 — Ocean Extra <= 2.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 5.4)
- CVE-2023-49164 — WordPress Ocean Extra Plugin <= 2.2.2 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 8.8)
- CVE-2020-36760 — Ocean Extra <=1.6.5 - Cross-Site Request Forgery Bypass (CVSS 4.3)
- CVE-2023-23891 — WordPress Ocean Extra Plugin <= 2.1.1 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.4)
- CVE-2023-24399 — WordPress Ocean Extra Plugin <= 2.1.2 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.4)
- CVE-2023-0749 — Ocean Extra < 2.1.3 - Subscriber+ Arbitrary Post Content Disclosure (CVSS 6.5)
- CVE-2022-3374 — Ocean Extra < 2.0.5 - Admin+ PHP Objection Injection (CVSS 7.2)
- CVE-2021-25104 — Ocean Extra < 1.9.5 - Reflected Cross-Site Scripting (CVSS 6.1)
- CVE-2019-16250 — (CVSS 7.5)