OceanWP vulnerabilities
We track 4 vulnerabilities in OceanWP products across 4 products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on October 29, 2026.
Latest OceanWP vulnerabilities
- 7.1 High severity
OceanWP: Improper Neutralization of Input During Web Page Generation
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in OceanWP OceanWP oceanwp allows Reflected XSS.This issue affects OceanWP: from n/a through 4.2.7.
- 7.2 High severity
Ocean Pro Demos: Improper Neutralization of Input During Web Page Generation
The Ocean Pro Demos and Ocean eComm Treasure Box plugins for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content' parameter in all versions up to, and including, 1.5.4, and 1.8.0, respectively, due to insufficient authorization, input sanit
- 9.8 Critical severity
Ocean Extra: Improper Control of Generation of Code
The Ocean Extra plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.4.6. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode
- 7.6 High severity
OceanWP: Improper Limitation of a Pathname to a Restricted Directory
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in OceanWP allows PHP Local File Inclusion.This issue affects OceanWP: from n/a through 3.4.1.