MAL-2025-28107 Malicious code in ocean-whale-efh080-project (npm)

The package ocean-whale-efh080-project was found to contain malicious code...

MAL-2025-23536 Malicious code in jacket-ocean-wds111-project (npm)

The package jacket-ocean-wds111-project was found to contain malicious code...

CVE-2025-49047

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in keeross DigitalOcean Spaces Sync do-spaces-sync allows Stored XSS.This issue affects DigitalOcean Spaces Sync: from n/a through = 2.2.1...

WordPress DigitalOcean Spaces Sync plugin <= 2.2.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Nabil Irawan Patchstack Alliance in WordPress Plugin DigitalOcean Spaces Sync versions = 2.2.1...

CVE-2025-8891

The OceanWP theme for WordPress is vulnerable to Cross-Site Request Forgery in versions 4.0.9 to 4.1.1. This is due to missing or incorrect nonce validation on the oceanwpnoticebuttonclick function. This makes it possible for unauthenticated attackers to install the Ocean Extra plugin via a forge...

CVE-2025-8891

The OceanWP theme for WordPress is vulnerable to Cross-Site Request Forgery in versions 4.0.9 to 4.1.1. This is due to missing or incorrect nonce validation on the oceanwpnoticebuttonclick function. This makes it possible for unauthenticated attackers to install the Ocean Extra plugin via a forge...

CVE-2025-8891 OceanWP <= 4.0.9 - 4.1.1 - Cross-Site Request Forgery to Ocean Extra Plugin Installation

The OceanWP theme for WordPress is vulnerable to Cross-Site Request Forgery in versions 4.0.9 to 4.1.1. This is due to missing or incorrect nonce validation on the oceanwpnoticebuttonclick function. This makes it possible for unauthenticated attackers to install the Ocean Extra plugin via a forge...

CVE-2025-8891

CVE-2025-8891 relates to the OceanWP WordPress theme. The affected versions are 4.0.9 through 4.1.1, where a Cross-Site Request Forgery can be exploited due to missing/incorrect nonce validation in the oceanwp_notice_button_click() function. This enables unauthenticated attackers to cause the ins...

CVE-2025-8891 OceanWP <= 4.0.9 - 4.1.1 - Cross-Site Request Forgery to Ocean Extra Plugin Installation

The OceanWP theme for WordPress is vulnerable to Cross-Site Request Forgery in versions 4.0.9 to 4.1.1. This is due to missing or incorrect nonce validation on the oceanwpnoticebuttonclick function. This makes it possible for unauthenticated attackers to install the Ocean Extra plugin via a forge...

PT-2025-32964

Name of the Vulnerable Software and Affected Versions: OceanWP versions 4.0.9 through 4.1.1 Description: The OceanWP theme for WordPress is susceptible to Cross-Site Request Forgery due to insufficient nonce validation within the oceanwp notice button click function. This allows unauthenticated...

WordPress OceanWP plugin <= 4.0.9 - 4.1.1 - Cross-Site Request Forgery to Ocean Extra Plugin Installation vulnerability

WordPress OceanWP plugin = 4.0.9 - 4.1.1 - Cross-Site Request Forgery to Ocean Extra Plugin Installation vulnerability discovered by Dmitrii Ignatyev in WordPress Theme OceanWP versions 4.0.9 - 4.1.1...

CVE-2025-7500

The Ocean Social Sharing plugin for WordPress is vulnerable to Stored Cross-Site Scripting via social icon titles in all versions up to, and including, 2.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level acce...

CVE-2025-7500

The Ocean Social Sharing plugin for WordPress is vulnerable to Stored Cross-Site Scripting via social icon titles in all versions up to, and including, 2.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level acce...

CVE-2025-7500 Ocean Social Sharing <= 2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Ocean Social Sharing plugin for WordPress is vulnerable to Stored Cross-Site Scripting via social icon titles in all versions up to, and including, 2.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level acce...

CVE-2025-7500

The CVE-2025-7500 entry concerns Ocean Social Sharing for WordPress. The vulnerability is a Stored Cross-Site Scripting flaw in social icon titles caused by insufficient input sanitization and output escaping, affecting all versions up to 2.2.1. Exploitation requires authenticated access at Contr...

WordPress plugin Ocean Social Sharing 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on servers running PHP and MySQL. WordPress plugin is an application plugin. A cross-site scripting vulnerability...

PT-2025-31737 · WordPress · Ocean Social Sharing

Name of the Vulnerable Software and Affected Versions: Ocean Social Sharing plugin for WordPress versions prior to 2.2.2 Description: The Ocean Social Sharing plugin for WordPress is susceptible to Stored Cross-Site Scripting through social icon titles due to insufficient input sanitization and...

CVE-2025-49068

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in oceanwp Ocean Extra ocean-extra allows Stored XSS.This issue affects Ocean Extra: from n/a through = 2.4.8...

CVE-2025-49068

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in oceanwp Ocean Extra ocean-extra allows Stored XSS.This issue affects Ocean Extra: from n/a through = 2.4.8...

CVE-2025-49068

CVE-2025-49068: Ocean Extra (OceanWP) stores XSS due to improper input neutralization during web page generation. Affected: Ocean Extra up to 2.4.8. Impact per metrics: confidentiality, integrity, availability Low; CVSSv3.1 base 6.5. Status: patched in Wordfence catalog; remediation is to update ...