WordPress Plugin Vulnerabilities

Ocean Extra < 2.5.0 - Contributor+ Stored XSS

Description

The plugin is vulnerable to Stored Cross-Site Scripting via the plugin's oceanwp_library shortcode due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Affects Plugins

Plugin icon
ocean-extra
Fixed in 2.5.0

References

CVE
CVE-2025-9499
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/290e9d95-0dac-4cc8-8cef-9e7974405f36

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
5.9 (medium)

Miscellaneous

Original Researcher
Muhammad Yudha - DJ
Verified
No
WPVDB ID
51ab82dc-e3ef-4c31-b229-dcfca4861302

Timeline

Publicly Published
2025-08-29 (about 8 months ago)
Added
2025-09-01 (about 8 months ago)
Last Updated
2025-09-01 (about 8 months ago)

Other

Published
Title
Published
2024-04-02
Title
Gutenberg Blocks by Kadence Blocks < 3.2.18 - Authenticated(Editor+) Stored Cross-Site Scripting via Contact Form Message Settings
Published
2025-08-05
Title
esri-map-view <= 1.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via esri-map-view Shortcode
Published
2026-02-05
Title
Employee Directory < 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'form_title' Shortcode Attribute
Published
2025-12-31
Title
The Moneytizer < 10.0.10 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2024-01-16
Title
WOLF < 1.0.8.1 - Unauthenticated Stored Cross-Site Scripting via profile_title