Skip to content
Noroxi

oceanwp records

18 published records for vendor oceanwp.

Researcher profile

Entered KEV
0 · 0%
Weaponized
0 · 0%
Pre-auth RCE
1
With a fix record
38.9%
Median publish → KEV
No record has entered KEV

Records by year

  1. 19
  2. 22
  3. 23
  4. 24
  5. 25

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

18 records
  • CVE-2025-3472
    40Plan

    Ocean Extra <= 2.4.6 - Unauthenticated Arbitrary Shortcode Execution

    CriticalCVSS 9.8Proof of conceptEPSS 2%

    oceanwp · ocean extraApr 22, 2025

  • CVE-2023-49164
    35Monitor

    WordPress Ocean Extra Plugin <= 2.2.2 is vulnerable to Cross Site Request Forgery (CSRF)

    HighCVSS 8.8No exploitEPSS 0%

    oceanwp · ocean extraDec 19, 2023

  • CVE-2019-16250
    30Monitor

    includes/wizard/wizard.php in the Ocean Extra plugin through 1.5.8 for WordPress allows unauthenticated options changes and injection of a C

    HighCVSS 7.5No exploitEPSS 1%

    oceanwp · ocean extraSep 11, 2019

  • CVE-2023-23700
    30Monitor

    WordPress OceanWP theme <= 3.4.1 - Authenticated Local File Inclusion vulnerability

    HighCVSS 7.6No exploitEPSS 1%

    oceanwp · oceanwpMay 17, 2024

  • CVE-2022-3374
    28Monitor

    Ocean Extra < 2.0.5 - Admin+ PHP Objection Injection

    HighCVSS 7.2No exploitEPSS 1%

    oceanwp · ocean extraOct 31, 2022

  • CVE-2023-0749
    26Monitor

    Ocean Extra < 2.1.3 - Subscriber+ Arbitrary Post Content Disclosure

    MediumCVSS 6.5No exploitEPSS 1%

    oceanwp · ocean extraMar 13, 2023

  • CVE-2022-35730
    26Monitor

    WordPress Oceanwp sticky header plugin <= 1.0.8 is vulnerable to Cross Site Request Forgery (CSRF)

    MediumCVSS 6.5No exploitEPSS 0%

    oceanwp · sticky headerDec 4, 2022

  • CVE-2024-3167
    25Monitor

    Ocean Extra <= 2.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting

    MediumCVSS 6.4No exploitEPSS 1%

    oceanwp · ocean extraApr 9, 2024

  • CVE-2021-25104
    24Monitor

    Ocean Extra < 1.9.5 - Reflected Cross-Site Scripting

    MediumCVSS 6.1Proof of conceptEPSS 1%

    oceanwp · ocean extraJun 20, 2022

  • CVE-2024-1277
    21Monitor

    Ocean Extra <= 2.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting

    MediumCVSS 5.4No exploitEPSS 0%

    oceanwp · ocean extraFeb 28, 2024

  • CVE-2023-24399
    21Monitor

    WordPress Ocean Extra Plugin <= 2.1.2 is vulnerable to Cross Site Scripting (XSS)

    MediumCVSS 5.4No exploitEPSS 0%

    oceanwp · ocean extraMar 30, 2023

  • CVE-2023-23891
    21Monitor

    WordPress Ocean Extra Plugin <= 2.1.1 is vulnerable to Cross Site Scripting (XSS)

    MediumCVSS 5.4No exploitEPSS 0%

    oceanwp · ocean extraApr 6, 2023

  • CVE-2024-37489
    21Monitor

    WordPress Ocean Extra plugin <= 2.2.9 - Authenticated Cross Site Scripting (XSS) vulnerability

    MediumCVSS 5.4No exploitEPSS 0%

    oceanwp · ocean extraJul 21, 2024

  • CVE-2025-3458
    21Monitor

    Ocean Extra <= 2.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'ocean_gallery_id'

    MediumCVSS 5.4No exploitEPSS 0%

    oceanwp · ocean extraApr 22, 2025

  • CVE-2025-3457
    21Monitor

    Ocean Extra <= 2.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

    MediumCVSS 5.4No exploitEPSS 0%

    oceanwp · ocean extraApr 22, 2025

  • CVE-2020-36760
    17Monitor

    Ocean Extra <=1.6.5 - Cross-Site Request Forgery Bypass

    MediumCVSS 4.3No exploitEPSS 1%

    oceanwp · ocean extraJul 12, 2023

  • CVE-2025-8944
    17Monitor

    OceanWP < 4.1.2 - Subscriber+ Limited Option Update

    MediumCVSS 4.3No exploitEPSS 0%

    oceanwp · oceanwpSep 5, 2025

  • CVE-2025-8891
    17Monitor

    OceanWP <= 4.0.9 - 4.1.1 - Cross-Site Request Forgery to Ocean Extra Plugin Installation

    MediumCVSS 4.3No exploitEPSS 0%

    oceanwp · oceanwpAug 13, 2025