240 matches found
Ocean Extra <= 2.4.6 - Unauthenticated Shortcode Execution
The Ocean Extra plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.4.6. This is due to the software allowing users to supply arbitrary shortcodes in the contentrechdata parameter that is then executed. This makes it possible for...
WordPress Ocean Extra <1.9.5 - Cross-Site Scripting
WordPress Ocean Extra plugin before 1.9.5 contains a cross-site scripting vulnerability. The plugin does not escape generated links which are then used when the OceanWP theme is active. id: CVE-2021-25104 info: name: WordPress Ocean Extra 1.9.5 - Cross-Site Scripting author: Akincibor severity:...
EUVD-2025-28862
The Ocean Extra plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's oceanwplibrary shortcode in all versions up to, and including, 2.4.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...
CVE-2026-86803
The The Ocean Extra plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.6.0 This is due to the software allowing users to execute an action that does not properly validate a value before running doshortcode. This makes it possible for...
EUVD-2026-101839
The The Ocean Extra plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.6.0 This is due to the software allowing users to execute an action that does not properly validate a value before running doshortcode. This makes it possible for...
CVE-2026-86803 Ocean Extra <= 2.6.0 - Unauthenticated Arbitrary Shortcode Execution via 'oceanwp_library' Shortcode Template
The The Ocean Extra plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.6.0 This is due to the software allowing users to execute an action that does not properly validate a value before running doshortcode. This makes it possible for...
CVE-2026-86803
The Ocean Extra plugin for WordPress is vulnerable to unauthenticated arbitrary shortcode execution in versions up to and including 2.6.0 . The flaw exists because the software allows the execution of an action that fails to properly validate a value before calling the do_shortcode function, spec...
CVE-2026-86803: Improper Control of Generation of Code
The The Ocean Extra plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.6.0 This is due to the software allowing users to execute an action that does not properly validate a value before running doshortcode. This makes it possible for...
WordPress Ocean Extra plugin <= 2.6.0 - Unauthenticated Arbitrary Shortcode Execution vulnerability
Unauthenticated Arbitrary Shortcode Execution vulnerability discovered by hashiramasenju333 in WordPress Plugin Ocean Extra versions = 2.6.0...
CVE-2026-94684
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. False positive detection...
EUVD-2026-85487
Contributor Cross Site Scripting XSS in Ocean Extra = 2.6.1 versions...
CVE-2026-94684
This CVE ID is rejected and does not represent an active vulnerability entry.
CVE-2026-94684
...
WordPress Ocean Extra plugin <= 2.6.1 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Ocean Extra versions = 2.6.1...
CVE-2026-94684: Undefined Security Weakness
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. False positive detection...
PT-2026-97472
Contributor Cross Site Scripting XSS in Ocean Extra = 2.6.1 versions...
CVE-2026-34903
Missing Authorization vulnerability in OceanWP Ocean Extra allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ocean Extra: from n/a through 2.5.3...
WordPress Ocean Extra plugin <= 2.4.2 - Unauthenticated Reflected Cross-Site Scripting vulnerability
Unauthenticated Reflected Cross-Site Scripting vulnerability discovered by Asaf Mozes in WordPress Plugin Ocean Extra versions = 2.4.2...