Plugin icon

Ocean Extra

ocean-extra

Vulnerabilities:

19

Last Updated:

November 24, 2025

Active Installs:

500000

Published
Title
Fixed in
CVSS
Published
2025-08-29
Title
Ocean Extra < 2.5.0 - Contributor+ Stored XSS
Fixed in
Fixed in 2.5.0
CVSS
5.9 (medium)
Published
2025-06-02
Title
Ocean Extra < 2.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
Fixed in
Fixed in 2.4.9
CVSS
5.4 (medium)
Published
2025-04-21
Title
Ocean Extra < 2.4.7 - Contributor+ Stored XSS via Shortcode
Fixed in
Fixed in 2.4.7
CVSS
5.9 (medium)
Published
2025-04-21
Title
Ocean Extra < 2.4.7 - Unauthenticated Arbitrary Shortcode Execution
Fixed in
Fixed in 2.4.7
CVSS
6.5 (medium)
Published
2025-04-21
Title
Ocean Extra < 2.4.7 - Contributor+ Stored XSS via 'ocean_gallery_id'
Fixed in
Fixed in 2.4.7
CVSS
5.9 (medium)
Published
2024-07-04
Title
Ocean Extra < 2.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Fixed in
Fixed in 2.3.0
CVSS
6.4 (medium)
Published
2024-06-10
Title
Ocean Extra < 2.2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Flickr Widget
Fixed in
Fixed in 2.2.9
CVSS
6.4 (medium)
Published
2024-04-08
Title
Ocean Extra < 2.2.7 - Contributor+ Stored Cross-Site Scripting
Fixed in
Fixed in 2.2.7
CVSS
6.4 (medium)
Published
2024-02-16
Title
Ocean Extra < 2.2.5 - Contributor+ Stored XSS
Fixed in
Fixed in 2.2.5
CVSS
5.9 (medium)
Published
2023-11-28
Title
Ocean Extra < 2.2.3 - Cross-Site Request Forgery to Arbitrary Plugin Activation
Fixed in
Fixed in 2.2.3
CVSS
4.3 (medium)
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Fixed in
Fixed in 2.1.8
CVSS
6.1 (medium)
Published
2023-02-14
Title
Ocean Extra < 2.1.3 - Subscriber+ Arbitrary Post Content Disclosure
Fixed in
Fixed in 2.1.3
CVSS
6.5 (medium)
Published
2023-02-14
Title
Ocean Extra < 2.1.3 - Contributor+ Stored XSS
Fixed in
Fixed in 2.1.3
CVSS
6.8 (medium)
Published
2023-02-02
Title
Ocean Extra < 2.1.2 - Contributor+ Stored XSS
Fixed in
Fixed in 2.1.2
CVSS
6.8 (medium)
Published
2022-10-10
Title
Ocean Extra < 2.0.5 - Admin+ PHP Objection Injection
Fixed in
Fixed in 2.0.5
CVSS
5.5 (medium)
Published
2022-05-24
Title
Ocean Extra < 1.9.5 - Reflected Cross-Site Scripting
Fixed in
Fixed in 1.9.5
CVSS
6.1 (medium)
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Fixed in
Fixed in 1.9.4
CVSS
4.3 (medium)
Published
2020-09-16
Title
Multiple Plugins/Themes - Cross-Site Request Forgery (CSRF)
Fixed in
Fixed in 1.6.6
CVSS
5.4 (medium)
Published
2019-07-04
Title
Ocean Extra <= 1.5.8 - Unauthenticated Settings change and CSS injection
Fixed in
Fixed in 1.5.9
CVSS
7.5 (high)