oceanwp Ocean Extra vulnerabilities

CVEs per yearBy the year they were published

1. 20234
2. 20245
3. 20255
4. 20263

Newest CVEs

• CVE-2026-86803

  Ocean Extra <= 2.6.0 - Unauthenticated Arbitrary Shortcode Execution via 'oceanwp_library' Shortcode Template

  oceanwp · Ocean Extra

  Medium6.5
• CVE-2024-13362

  Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter

  sebet · Go Fetch Jobs (for WP Job Manager)

  Medium6.1
• CVE-2026-34903

  WordPress Ocean Extra plugin <= 2.5.3 - Broken Access Control vulnerability

  OceanWP · Ocean Extra

  Medium5.4
• CVE-2025-9499

  Ocean Extra <= 2.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via oceanwp_library Shortcode

  oceanwp · Ocean Extra

  Medium6.4
• CVE-2025-49068

  WordPress Ocean Extra plugin <= 2.4.8 - Cross Site Scripting (XSS) vulnerability

  oceanwp · Ocean Extra

  Medium6.5
• CVE-2025-3458

  Ocean Extra <= 2.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'ocean_gallery_id'

  oceanwp · Ocean Extra

  Medium6.4
• CVE-2025-3472

  Ocean Extra <= 2.4.6 - Unauthenticated Arbitrary Shortcode Execution

  oceanwp · Ocean Extra

  Medium6.5
• CVE-2025-3457

  Ocean Extra <= 2.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

  oceanwp · Ocean Extra

  Medium6.4
• CVE-2022-4974

  Freemius SDK <= 2.4.2 - Missing Authorization Checks

  dashlabsltd · YASR – Yet Another Star Rating Plugin for WordPress

  Medium6.3
• CVE-2024-37489

  WordPress Ocean Extra plugin <= 2.2.9 - Authenticated Cross Site Scripting (XSS) vulnerability

  OceanWP · Ocean Extra

  Medium6.5