VendorsOceanWPocean_extraany version
Vulnerabilities

OceanWP Ocean Extra any version

Ranked by severity, then by exploit likelihood. Click a CVE ID for its full record.

14CVEs
CVE-2025-3472
Ocean Extra <= 2.4.6 - Unauthenticated Arbitrary Shortcode Execution
Published 2025-04-22 · Analyzed
9.8EPSS 0.020
CVE-2023-49164
WordPress Ocean Extra Plugin <= 2.2.2 is vulnerable to Cross Site Request Forgery (CSRF)
Published 2023-12-19 · Modified
8.8EPSS 0.003
CVE-2019-16250
includes/wizard/wizard.php in the Ocean Extra plugin through 1.5.8 for WordPress allows unauthenticated options changes and injection of a Cascading Style Sheets (CSS) token sequence.
Published 2019-09-11 · Modified
7.5EPSS 0.014
CVE-2022-3374
Ocean Extra < 2.0.5 - Admin+ PHP Objection Injection
Published 2022-10-31 · Modified
7.2EPSS 0.012
CVE-2023-0749
Ocean Extra < 2.1.3 - Subscriber+ Arbitrary Post Content Disclosure
Published 2023-03-13 · Modified
6.5EPSS 0.007
CVE-2024-37489
WordPress Ocean Extra plugin <= 2.2.9 - Authenticated Cross Site Scripting (XSS) vulnerability
Published 2024-07-21 · Modified
6.5EPSS 0.003
CVE-2024-3167
Ocean Extra <= 2.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published 2024-04-09 · Modified
6.4EPSS 0.005
CVE-2024-1277
Ocean Extra <= 2.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published 2024-02-20 · Modified
6.4EPSS 0.005
CVE-2025-3457
Ocean Extra <= 2.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Published 2025-04-22 · Analyzed
6.4EPSS 0.003
CVE-2025-3458
Ocean Extra <= 2.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'ocean_gallery_id'
Published 2025-04-22 · Analyzed
6.4EPSS 0.003
CVE-2021-25104
Ocean Extra < 1.9.5 - Reflected Cross-Site Scripting
Published 2022-06-20 · Modified
6.1EPSS 0.014
CVE-2023-24399
WordPress Ocean Extra Plugin <= 2.1.2 is vulnerable to Cross Site Scripting (XSS)
Published 2023-03-30 · Modified
5.5EPSS 0.003
CVE-2023-23891
WordPress Ocean Extra Plugin <= 2.1.1 is vulnerable to Cross Site Scripting (XSS)
Published 2023-04-06 · Modified
5.5EPSS 0.003
CVE-2020-36760
Ocean Extra <=1.6.5 - Cross-Site Request Forgery Bypass
Published 2023-07-12 · Modified
4.3EPSS 0.006