Medium severity · published Oct 15, 2026
CVE-2026-86803
Ocean Extra <= 2.6.0 - Unauthenticated Arbitrary Shortcode Execution via 'oceanwp_library' Shortcode Template
6.5
CVSS
0.2%
EPSS
No
On KEV
Description
The The Ocean Extra plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.6.0 This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 13% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OE
Ocean Extra · oceanwp
through 2.6.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-86803
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-86803
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/changeset/3689650/ocean-extra/trunk/includes/panel/library-shortcode.php
www.wordfence.com
https://www.wordfence.com/threat-intel/vulnerabilities/id/3863cc3a-7532-4925-9b59-909cfd45501a?source=cve
More from Ocean Extra
9.8
CVE-2025-3472
Ocean Extra <= 2.4.6 - Unauthenticated Arbitrary Shortcode Execution
8.8
CVE-2023-49164
WordPress Ocean Extra Plugin <= 2.2.2 is vulnerable to Cross Site Request Forgery (CSRF)
7.5
CVE-2019-16250
includes/wizard/wizard.php in the Ocean Extra plugin through 1.5.8 for WordPress allows unauthenticated options changes and injection of a Cascading Style Sheets (CSS) token…
7.2
CVE-2022-3374
Ocean Extra < 2.0.5 - Admin+ PHP Objection Injection
6.5
CVE-2025-49068
WordPress Ocean Extra plugin <= 2.4.8 - Cross Site Scripting (XSS) vulnerability