Threat Entry Updated 2026-01-20

CVE-2025-8944 - Oceanwp Theme

The OceanWP WordPress theme before 4.1.2 is vulnerable to an option update due to a missing capability check on one of its AJAX request handler, allowing any authenticated users, such as subscriber to update the darkMod` setting.

THEME Oceanwp

CVE-2025-8944

MEDIUM CVSS 4.3 2025-09-05

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2025-12-18

CVE-2025-8891 - Oceanwp Plugin

The OceanWP theme for WordPress is vulnerable to Cross-Site Request Forgery in versions 4.0.9 to 4.1.1. This is due to missing or incorrect nonce validation on the oceanwp_notice_button_click() function. This makes it possible for unauthenticated attackers to install the Ocean Extra plugin via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

PLUGIN Oceanwp

CVE-2025-8891

MEDIUM CVSS 4.3 2025-08-13

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2025-06-23

CVE-2025-5524 - Oceanwp Theme

The OceanWP theme for WordPress is vulnerable to Stored Cross-Site Scripting via the Select HTML tag in all versions up to, and including, 4.0.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

THEME Oceanwp

CVE-2025-5524

MEDIUM CVSS 4.9 2025-06-19

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2025-04-30

CVE-2025-3457 - Oceanwp Theme

The Ocean Extra plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'oceanwp_icon' shortcode in all versions up to, and including, 2.4.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

THEME Oceanwp

CVE-2025-3457

MEDIUM CVSS 6.4 2025-04-22

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2024-11-21

CVE-2024-2476 - OceanWP Plugin

The OceanWP theme for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the load_theme_panel_pane function in all versions up to, and including, 3.5.4. This makes it possible for authenticated attackers, with subscriber-level access and above, to expose sensitive information such as system/environment data and API keys.

PLUGIN OceanWP

CVE-2024-2476

MEDIUM CVSS 4.3 2024-03-29

Risk Score

Open Full Technical Breakdown