WordPress Plugin Vulnerabilities

Ocean Extra < 2.6.2 - Contributor+ Stored XSS

Description

The plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Affects Plugins

Plugin icon
ocean-extra
Fixed in 2.6.2

References

CVE
CVE-2026-94684
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/94fcfa8d-4865-40ee-be93-8e651ec1f371

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
5.5 (medium)

Miscellaneous

Original Researcher
Ananda Dhakal
Verified
No
WPVDB ID
a412ae96-e13e-4004-b054-6b0006c5474f

Timeline

Publicly Published
2026-09-23 (about 24 days ago)
Added
2026-09-30 (about 17 days ago)
Last Updated
2026-09-30 (about 17 days ago)

Other

Published
Title
Published
2024-06-11
Title
Premium Addons for Elementor < 4.10.34 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting
Published
2024-11-21
Title
AffiliateImporterEb <= 1.0.6 - Reflected XSS
Published
2025-02-18
Title
Cosmic Blocks (40+) Content Editor Blocks Collection <= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2026-07-22
Title
WP Shortcode by MyThemeShop <= 1.4.17 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'title' Shortcode Attribute
Published
2024-03-22
Title
Page Builder by SiteOrigin < 2.29.7 - Contributor+ Stored XSS