Oceanwp
Oceanwp Ocean Extra: vulnerabilidades y CVE
Oceanwp Ocean Extra tiene 18 vulnerabilidades publicadas, 1 de ellas en los últimos 12 meses. 1 son críticas y 0 figuran en el catálogo de explotación activa de CISA.
CVE18
Últimos 12 meses1
Críticas1
Explotadas activamente0
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2026-34903 | Media (5.4) | 0.29% | — | 7 abr 2026 | Missing Authorization vulnerability in OceanWP Ocean Extra allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ocean Extra: from n/a through 2.5.3. |
| CVE-2025-9499 | Media (6.4) | 0.25% | — | 30 ago 2025 | The Ocean Extra plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's oceanwp_library shortcode in all versions up to, and including, 2.4.9 due to insufficient input sanitization and output… |
| CVE-2025-49068 | Media (6.5) | 0.20% | — | 6 jun 2025 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in oceanwp Ocean Extra ocean-extra allows Stored XSS.This issue affects Ocean Extra: from n/a through <= 2.4.8. |
| CVE-2025-3472 | Crítica (9.8) | 2.0% | — | 22 abr 2025 | The Ocean Extra plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.4.6. This is due to the software allowing users to execute an action that does not properly… |
| CVE-2025-3458 | Media (5.4) | 0.29% | — | 22 abr 2025 | The Ocean Extra plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ocean_gallery_id’ parameter in all versions up to, and including, 2.4.6 due to insufficient input sanitization and output… |
| CVE-2025-3457 | Media (5.4) | 0.29% | — | 22 abr 2025 | The Ocean Extra plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'oceanwp_icon' shortcode in all versions up to, and including, 2.4.6 due to insufficient input sanitization and output… |
| CVE-2024-37489 | Media (5.4) | 0.31% | — | 21 jul 2024 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in OceanWP Ocean Extra allows Stored XSS.This issue affects Ocean Extra: from n/a through 2.2.9. |
| CVE-2024-5531 | Media (6.4) | 0.31% | — | 11 jun 2024 | The Ocean Extra plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Flickr widget in all versions up to, and including, 2.2.8 due to insufficient input sanitization and output escaping on user… |
| CVE-2024-3167 | Media (6.4) | 0.51% | — | 9 abr 2024 | The Ocean Extra plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘twitter_username’ parameter in versions up to, and including, 2.2.6 due to insufficient input sanitization and output escaping.… |
| CVE-2024-1277 | Media (5.4) | 0.46% | — | 29 feb 2024 | The Ocean Extra plugin for WordPress is vulnerable to Stored Cross-Site Scripting via custom fields in all versions up to, and including, 2.2.4 due to insufficient input sanitization and output escaping. This makes it… |
| CVE-2023-49164 | Alta (8.8) | 0.29% | — | 19 dic 2023 | Cross-Site Request Forgery (CSRF) vulnerability in OceanWP Ocean Extra.This issue affects Ocean Extra: from n/a through 2.2.2. |
| CVE-2020-36760 | Media (4.3) | 0.56% | — | 12 jul 2023 | The Ocean Extra plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.6.5]. This is due to missing or incorrect nonce validation on the… |
| CVE-2023-23891 | Media (5.4) | 0.34% | — | 6 abr 2023 | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in OceanWP Ocean Extra plugin <= 2.1.1 versions. Needs the OceanWP theme installed and activated. |
| CVE-2023-24399 | Media (5.4) | 0.34% | — | 30 mar 2023 | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in OceanWP Ocean Extra plugin <= 2.1.2 versions. |
| CVE-2023-0749 | Media (6.5) | 0.65% | — | 13 mar 2023 | The Ocean Extra WordPress plugin before 2.1.3 does not ensure that the template to be loaded via a shortcode is actually a template, allowing any authenticated users such as subscriber to retrieve the content of… |
| CVE-2022-3374 | Alta (7.2) | 1.2% | — | 31 oct 2022 | The Ocean Extra WordPress plugin before 2.0.5 unserialises the content of an imported file, which could lead to PHP object injections issues when a high privilege user import (intentionally or not) a malicious… |
| CVE-2021-25104 | Media (6.1) | 1.4% | — | 20 jun 2022 | The Ocean Extra WordPress plugin before 1.9.5 does not escape generated links which are then used when the OceanWP is active, leading to a Reflected Cross-Site Scripting issue |
| CVE-2019-16250 | Alta (7.5) | 1.4% | — | 11 sept 2019 | includes/wizard/wizard.php in the Ocean Extra plugin through 1.5.8 for WordPress allows unauthenticated options changes and injection of a Cascading Style Sheets (CSS) token sequence. |