# cve.now: Oceanwp

The newest entries naming Oceanwp as an affected vendor (up to 200), of 26 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-115592](https://cve.now/CVE-2026-115592.md): WordPress OceanWP theme \<= 4.2.7 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-86803](https://cve.now/CVE-2026-86803.md): Ocean Extra \<= 2.6.0 - Unauthenticated Arbitrary Shortcode Execution via 'oceanwp\_library' Shortcode Template (CVSS 6.5)
- [CVE-2026-81929](https://cve.now/CVE-2026-81929.md): Ocean Pro Demos \<= 1.5.4 and Ocean eComm Treasure Box \<= 1.8.0 - Unauthenticated Stored Cross-Site Scripting via 'content' Parameter (CVSS 7.2)
- [CVE-2026-56007](https://cve.now/CVE-2026-56007.md): WordPress Ocean Product Sharing plugin \<= 2.2.2 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9)
- [CVE-2024-13362](https://cve.now/CVE-2024-13362.md): Freemius \<= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter (CVSS 6.1)
- [CVE-2026-34903](https://cve.now/CVE-2026-34903.md): WordPress Ocean Extra plugin \<= 2.5.3 - Broken Access Control vulnerability (CVSS 5.4)
- [CVE-2025-9499](https://cve.now/CVE-2025-9499.md): Ocean Extra \<= 2.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via oceanwp\_library Shortcode (CVSS 6.4)
- [CVE-2025-8891](https://cve.now/CVE-2025-8891.md): OceanWP \<= 4.0.9 - 4.1.1 - Cross-Site Request Forgery to Ocean Extra Plugin Installation (CVSS 4.3)
- [CVE-2025-7500](https://cve.now/CVE-2025-7500.md): Ocean Social Sharing \<= 2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4)
- [CVE-2024-5647](https://cve.now/CVE-2024-5647.md): Multiple Plugins \<= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Magnific Popups JavaScript Library (CVSS 6.4)
- [CVE-2025-5524](https://cve.now/CVE-2025-5524.md): OceanWP \<= 4.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Select HTML Tag (CVSS 4.9)
- [CVE-2025-49068](https://cve.now/CVE-2025-49068.md): WordPress Ocean Extra plugin \<= 2.4.8 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2025-3458](https://cve.now/CVE-2025-3458.md): Ocean Extra \<= 2.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'ocean\_gallery\_id' (CVSS 6.4)
- [CVE-2025-3472](https://cve.now/CVE-2025-3472.md): Ocean Extra \<= 2.4.6 - Unauthenticated Arbitrary Shortcode Execution (CVSS 6.5)
- [CVE-2025-3457](https://cve.now/CVE-2025-3457.md): Ocean Extra \<= 2.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4)
- [CVE-2022-4974](https://cve.now/CVE-2022-4974.md): Freemius SDK \<= 2.4.2 - Missing Authorization Checks (CVSS 6.3)
- [CVE-2024-37489](https://cve.now/CVE-2024-37489.md): WordPress Ocean Extra plugin \<= 2.2.9 - Authenticated Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2024-5531](https://cve.now/CVE-2024-5531.md): Ocean Extra \<= 2.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Flickr Widget (CVSS 6.4)
- [CVE-2023-23700](https://cve.now/CVE-2023-23700.md): WordPress OceanWP theme \<= 3.4.1 - Authenticated Local File Inclusion vulnerability (CVSS 7.6)
- [CVE-2024-3167](https://cve.now/CVE-2024-3167.md): Ocean Extra \<= 2.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4)
- [CVE-2024-2476](https://cve.now/CVE-2024-2476.md): OceanWP \<= 3.5.4 - Missing Authorization to Sensitive Information Exposure via Limited Local File Inclusion (CVSS 4.3)
- [CVE-2024-1277](https://cve.now/CVE-2024-1277.md): Ocean Extra \<= 2.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4)
- [CVE-2023-49164](https://cve.now/CVE-2023-49164.md): WordPress Ocean Extra Plugin \<= 2.2.2 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4)
- [CVE-2020-36760](https://cve.now/CVE-2020-36760.md): Ocean Extra \<=1.6.5 - Cross-Site Request Forgery Bypass (CVSS 4.3)
- [CVE-2023-23891](https://cve.now/CVE-2023-23891.md): WordPress Ocean Extra Plugin \<= 2.1.1 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.5)
- [CVE-2023-24399](https://cve.now/CVE-2023-24399.md): WordPress Ocean Extra Plugin \<= 2.1.2 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.5)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/oceanwp
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.