High severity · published Oct 29, 2026
CVE-2026-115592
WordPress OceanWP theme <= 4.2.7 - Cross Site Scripting (XSS) vulnerability
New
7.1
CVSS
–
EPSS
No
On KEV
Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in OceanWP OceanWP oceanwp allows Reflected XSS.This issue affects OceanWP: from n/a through 4.2.7.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Changed
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OC
OceanWP · OceanWP
through 4.2.7 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-115592
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-115592
vdb-entry
https://patchstack.com/database/wordpress/theme/oceanwp/vulnerability/wordpress-oceanwp-theme-4-2-7-cross-site-scripting-xss-vulnerability?_s_id=cve
More from OceanWP
7.6
CVE-2023-23700
WordPress OceanWP theme <= 3.4.1 - Authenticated Local File Inclusion vulnerability
6.4
CVE-2024-5647
Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Magnific Popups JavaScript Library
4.9
CVE-2025-5524
OceanWP <= 4.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Select HTML Tag
4.3
CVE-2025-8944
OceanWP < 4.1.2 - Subscriber+ Limited Option Update
4.3
CVE-2025-8891
OceanWP <= 4.0.9 - 4.1.1 - Cross-Site Request Forgery to Ocean Extra Plugin Installation