OC
Vendor
oceanwp
31
CVEs
0
On KEV
4
New 30D
Products
OE9.8
Ocean Extra
oceanwp
19 CVEs0 on KEV1 new
OC7.6
OceanWP
oceanwp
7 CVEs0 on KEV1 new
OE7.2
Ocean eComm Treasure Box
OceanWP
1 CVEs0 on KEV1 new
OP7.2
Ocean Pro Demos
OceanWP
1 CVEs0 on KEV1 new
OP5.9
Ocean Product Sharing
OceanWP
1 CVEs0 on KEV0 new
OS6.4
Ocean Social Sharing
oceanwp
1 CVEs0 on KEV0 new
SH6.5
Sticky Header
Oceanwp
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-115592 New | OC OceanWP OceanWP | 7.1 | Oct 29 | WordPress OceanWP theme <= 4.2.7 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-86803 | OE Ocean Extra oceanwp | 6.5 | Oct 15 | Ocean Extra <= 2.6.0 - Unauthenticated Arbitrary Shortcode Execution via 'oceanwp_library' Shortcode Template |
| CVE-2026-81929 | OP Ocean Pro Demos OceanWP | 7.2 | Oct 9 | Ocean Pro Demos <= 1.5.4 and Ocean eComm Treasure Box <= 1.8.0 - Unauthenticated Stored Cross-Site Scripting via 'content' Parameter |
| CVE-2026-56007 | OP Ocean Product Sharing OceanWP | 5.9 | Jun 18 | WordPress Ocean Product Sharing plugin <= 2.2.2 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-34903 | OE Ocean Extra OceanWP | 5.4 | Apr 7 | WordPress Ocean Extra plugin <= 2.5.3 - Broken Access Control vulnerability |
| CVE-2025-8944 | OC Oceanwp Oceanwp | 4.3 | Sep 5 | OceanWP < 4.1.2 - Subscriber+ Limited Option Update |
| CVE-2025-9499 | OE Ocean Extra oceanwp | 6.4 | Aug 30 | Ocean Extra <= 2.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via oceanwp_library Shortcode |
| CVE-2025-8891 | OC OceanWP oceanwp | 4.3 | Aug 13 | OceanWP <= 4.0.9 - 4.1.1 - Cross-Site Request Forgery to Ocean Extra Plugin Installation |
| CVE-2025-7500 | OS Ocean Social Sharing oceanwp | 6.4 | Aug 2 | Ocean Social Sharing <= 2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting |
| CVE-2024-5647 | OC OceanWP oceanwp | 6.4 | Jul 3 | Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Magnific Popups JavaScript Library |
| CVE-2025-5524 | OC OceanWP oceanwp | 4.9 | Jun 19 | OceanWP <= 4.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Select HTML Tag |
| CVE-2025-49068 | OE Ocean Extra oceanwp | 6.5 | Jun 6 | WordPress Ocean Extra plugin <= 2.4.8 - Cross Site Scripting (XSS) vulnerability |
| CVE-2025-3458 | OE Ocean Extra oceanwp | 5.4 | Apr 22 | Ocean Extra <= 2.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'ocean_gallery_id' |
| CVE-2025-3472 | OE Ocean Extra oceanwp | 9.8 | Apr 22 | Ocean Extra <= 2.4.6 - Unauthenticated Arbitrary Shortcode Execution |
| CVE-2025-3457 | OE Ocean Extra oceanwp | 5.4 | Apr 22 | Ocean Extra <= 2.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode |
| CVE-2024-37489 | OE Ocean Extra OceanWP | 5.4 | Jul 21 | WordPress Ocean Extra plugin <= 2.2.9 - Authenticated Cross Site Scripting (XSS) vulnerability |
| CVE-2024-5531 | OE Ocean Extra oceanwp | 6.4 | Jun 11 | Ocean Extra <= 2.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Flickr Widget |
| CVE-2023-23700 | OC OceanWP OceanWP | 7.6 | May 17 | WordPress OceanWP theme <= 3.4.1 - Authenticated Local File Inclusion vulnerability |
| CVE-2024-3167 | OE Ocean Extra oceanwp | 6.4 | Apr 9 | Ocean Extra <= 2.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting |
| CVE-2024-2476 | OC OceanWP oceanwp | 4.3 | Mar 29 | OceanWP <= 3.5.4 - Missing Authorization to Sensitive Information Exposure via Limited Local File Inclusion |
| CVE-2024-1277 | OE Ocean Extra oceanwp | 5.4 | Feb 20 | Ocean Extra <= 2.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting |
| CVE-2023-49164 | OE Ocean Extra OceanWP | 8.8 | Dec 19 | WordPress Ocean Extra Plugin <= 2.2.2 is vulnerable to Cross Site Request Forgery (CSRF) |
| CVE-2020-36760 | OE Ocean Extra Oceanwp | 4.3 | Jul 12 | The Ocean Extra plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.6.5] |
| CVE-2023-23891 | OE Ocean Extra Oceanwp | 5.4 | Apr 6 | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in OceanWP Ocean Extra plugin <= 2.1.1 versions. Needs the OceanWP theme installed and activated |
| CVE-2023-24399 | OE Ocean Extra Oceanwp | 5.4 | Mar 30 | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in OceanWP Ocean Extra plugin <= 2.1.2 versions |
| CVE-2023-0749 | OE Ocean Extra Oceanwp | 6.5 | Mar 13 | The Ocean Extra WordPress plugin before 2.1.3 does not ensure that the template to be loaded via a shortcode is actually a template, allowing any authenticated users such as… |
| CVE-2022-35730 | SH Sticky Header Oceanwp | 6.5 | Dec 4 | Cross-Site Request Forgery (CSRF) vulnerability in Oceanwp sticky header plugin <= 1.0.8 on WordPress |
| CVE-2022-3374 | OE Ocean Extra Oceanwp | 7.2 | Oct 31 | Ocean Extra < 2.0.5 - Admin+ PHP Objection Injection |
| CVE-2021-25104 | OE Ocean Extra Oceanwp | 6.1 | Jun 20 | The Ocean Extra WordPress plugin before 1.9.5 does not escape generated links which are then used when the OceanWP is active, leading to a Reflected Cross-Site Scripting issue |
| CVE-2019-16250 | OE Ocean Extra Oceanwp | 7.5 | Sep 11 | includes/wizard/wizard.php in the Ocean Extra plugin through 1.5.8 for WordPress allows unauthenticated options changes and injection of a Cascading Style Sheets (CSS) token… |