Extension WordPress
Vulnérabilités Ocean Extra
Cette page rassemble les failles publiées pour Ocean Extra, leurs plages de versions affectées et les correctifs signalés dans la base locale.
Historique de sécurité
CVE et vulnérabilités de Ocean Extra
21 fiches
Freemius <= 2.10.1 – Reflected DOM-Based Cross-Site Scripting via url Parameter
Multiple plugins and/or themes for WordPress are vulnerable to Reflected Cross-Site Scripting via the url parameter in various versions due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web…
*-2.4.2
2.4.4
30/04/2026
Ocean Extra <= 2.5.3 – Missing Authorization
The Ocean Extra plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 2.5.3. This makes it possible for authenticated attackers, with Subscriber-level access…
*-2.5.3
2.5.4
07/04/2026
Ocean Extra <= 2.4.9 – Authenticated (Contributor+) Stored Cross-Site Scripting via oceanwp_library Shortcode
The Ocean Extra plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's oceanwp_library shortcode in all versions up to, and including, 2.4.9 due to insufficient input sanitization and output escaping on user supplied attributes. This…
*-2.4.9
2.5.0
29/08/2025
Ocean Extra <= 2.4.8 – Authenticated (Contributor+) Stored Cross-Site Scripting
The Ocean Extra plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.4.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access…
*-2.4.8
2.4.9
02/06/2025
Ocean Extra <= 2.4.6 – Authenticated (Contributor+) Stored Cross-Site Scripting via 'ocean_gallery_id'
The Ocean Extra plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ocean_gallery_id’ parameter in all versions up to, and including, 2.4.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated…
*-2.4.6
2.4.7
21/04/2025
Ocean Extra <= 2.4.6 – Unauthenticated Arbitrary Shortcode Execution
The Ocean Extra plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.4.6. This is due to the software allowing users to execute an action that does not properly validate a…
*-2.4.6
2.4.7
21/04/2025
Ocean Extra <= 2.4.6 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
The Ocean Extra plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'oceanwp_icon' shortcode in all versions up to, and including, 2.4.6 due to insufficient input sanitization and output escaping on user supplied attributes. This…
*-2.4.6
2.4.7
21/04/2025
Ocean Extra <= 2.2.9 – Authenticated (Contributor+) Stored Cross-Site Scripting
The Ocean Extra plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.2.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and…
*-2.2.9
2.3.0
04/07/2024
Ocean Extra <= 2.2.8 – Authenticated (Contributor+) Stored Cross-Site Scripting via Flickr Widget
The Ocean Extra plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Flickr widget in all versions up to, and including, 2.2.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes…
*-2.2.8
2.2.9
10/06/2024
Ocean Extra <= 2.2.6 – Authenticated (Contributor+) Stored Cross-Site Scripting
The Ocean Extra plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘twitter_username’ parameter in versions up to, and including, 2.2.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,…
*-2.2.6
2.2.7
08/04/2024
Ocean Extra <= 2.2.4 – Authenticated (Contributor+) Stored Cross-Site Scripting
The Ocean Extra plugin for WordPress is vulnerable to Stored Cross-Site Scripting via custom fields in all versions up to, and including, 2.2.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,…
*-2.2.4
2.2.5
16/02/2024
Ocean Extra <= 2.2.2 – Cross-Site Request Forgery to Arbitrary Plugin Activation
The Ocean Extra plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2.2. This is due to missing or incorrect nonce validation on the ajax_required_plugins_activate() function. This makes it possible for…
*-2.2.2
2.2.3
28/11/2023
Freemius SDK <= 2.5.9 – Reflected Cross-Site Scripting via fs_request_get
The Freemius SDK for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘fs_request_get’ function in versions up to, and including, 2.5.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to…
1.5.12-2.1.6
2.1.8
18/07/2023
Ocean Extra <= 2.1.2 – Authenticated (Contributor+) Stored Cross-Site Scripting
The Ocean Extra plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in versions up to, and including, 2.1.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it…
*-2.1.2
2.1.3
14/02/2023
Ocean Extra <= 2.1.2 – Authenticated (Subscriber+) Arbitrary Post Access
The Ocean Extra for WordPress is vulnerable to disclosure of potentially sensitive data in versions up to, and including, 2.1.2. This is due to to the [oceanwp_library] shortcode not properly validating a post's status prior to returning the…
*-2.1.2
2.1.3
14/02/2023
Ocean Extra <= 2.1.1 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
The Ocean Extra plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in versions up to, and including, 2.1.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it…
*-2.1.1
2.1.2
01/02/2023
Ocean Extra <= 2.0.4 – Authenticated (Administrator+) PHP Object Injection
The Ocean Extra plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 2.0.4 via deserialization of untrusted input when processing a malicious customizer styling file. This allows administrator-level attackers to inject a…
*-2.0.4
2.0.5
10/10/2022
Ocean Extra <= 1.9.4 – Reflected Cross-Site Scripting
The Ocean Extra WordPress plugin before 1.9.5 does not escape generated links which are then used when the OceanWP is active, leading to a Reflected Cross-Site Scripting issue
[*, 1.9.5)
1.9.5
24/05/2022
Freemius SDK <= 2.4.2 – Missing Authorization Checks
The Freemius SDK, as used by hundreds of WordPress plugin and theme developers, was vulnerable to Cross-Site Request Forgery and Information disclosure due to missing capability checks and nonce protection on the _get_debug_log, _get_db_option, and the _set_db_option functions…
[*, 1.9.4)
1.9.4
04/03/2022
Ocean Extra <=1.6.5 – Cross-Site Request Forgery Bypass
The Ocean Extra plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.6.5]. This is due to missing or incorrect nonce validation on the add_core_extensions_bundle_validation() function. This makes it possible for unauthenticated…
[*, 1.6.6)
1.6.6
26/09/2020
Extensions également surveillés
WP Commander
Rechercher dans toute la base WordPress
Utilisez la recherche globale pour retrouver une extension, un thème, une CVE ou un identifiant de vulnérabilité.