WordSec
WordSec

Ocean Extra

Explore Ocean Extra vulnerabilities across all versions. Currently tracking 21 known vulnerabilities, including severity, impact, and patch status.

01234567891003.07.2019Today03.07.20197.5Ocean Extra <= 1.5.7 - Unauthenticated Options update and CSS injection CVSS 7.5 · 03.07.201926.09.20204.3Ocean Extra <=1.6.5 - Cross-Site Request Forgery Bypass CVSS 4.3 · 26.09.202004.03.20226.3Freemius SDK <= 2.4.2 - Missing Authorization Checks CVSS 6.3 · 04.03.202224.05.20226.1Ocean Extra <= 1.9.4 - Reflected Cross-Site Scripting CVSS 6.1 · 24.05.202210.10.20227.2Ocean Extra <= 2.0.4 - Authenticated (Administrator+) PHP Object Injection CVSS 7.2 · 10.10.202201.02.20236.4Ocean Extra <= 2.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode CVSS 6.4 · 01.02.202314.02.20236.4Ocean Extra <= 2.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting CVSS 6.4 · 14.02.20236.5Ocean Extra <= 2.1.2 - Authenticated (Subscriber+) Arbitrary Post Access CVSS 6.5 · 14.02.202318.07.20236.1Freemius SDK <= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get CVSS 6.1 · 18.07.202328.11.20234.3Ocean Extra <= 2.2.2 - Cross-Site Request Forgery to Arbitrary Plugin Activation CVSS 4.3 · 28.11.202316.02.20246.4Ocean Extra <= 2.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting CVSS 6.4 · 16.02.202408.04.20246.4Ocean Extra <= 2.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting CVSS 6.4 · 08.04.202410.06.20246.4Ocean Extra <= 2.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Flickr Widget CVSS 6.4 · 10.06.202404.07.20246.4Ocean Extra <= 2.2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting CVSS 6.4 · 04.07.202421.04.20256.4Ocean Extra <= 2.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'ocean_gallery_id' CVSS 6.4 · 21.04.20256.5Ocean Extra <= 2.4.6 - Unauthenticated Arbitrary Shortcode Execution CVSS 6.5 · 21.04.20256.4Ocean Extra <= 2.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode CVSS 6.4 · 21.04.202502.06.20255.4Ocean Extra <= 2.4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting CVSS 5.4 · 02.06.202529.08.20256.4Ocean Extra <= 2.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via oceanwp_library Shortcode CVSS 6.4 · 29.08.202507.04.20264.3Ocean Extra <= 2.5.3 - Missing Authorization CVSS 4.3 · 07.04.202630.04.20266.1Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter CVSS 6.1 · 30.04.2026

Strategic Overview

Avg CVSSMedium
6.1/ 10
Patch Coverage100%
Open

0

Fixed

21

Get automatic notifications for all Ocean Extra vulnerabilities before they are exploited.

Vulnerability Records

21 records
2026-04-30 17:17
Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter
Ocean Extra
<= 2.4.2
CVE-2024-13362
6.1
Medium
Asaf MozesYes
2026-04-07 00:00
Ocean Extra <= 2.5.3 - Missing Authorization
Ocean Extra
<= 2.5.3
CVE-2026-34903
4.3
Medium
Nguyen Ba KhanhYes
2025-08-29 16:24
Ocean Extra <= 2.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via oceanwp_library Shortcode
Ocean Extra
<= 2.4.9
CVE-2025-9499
6.4
Medium
Muhammad Yudha - DJYes
2025-06-02 00:00
Ocean Extra <= 2.4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
Ocean Extra
<= 2.4.8
CVE-2025-49068
5.4
Medium
Asaf MozesYes
2025-04-21 00:00
Ocean Extra <= 2.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'ocean_gallery_id'
Ocean Extra
<= 2.4.6
CVE-2025-3458
6.4
Medium
Muhammad Yudha - DJYes
2025-04-21 00:00
Ocean Extra <= 2.4.6 - Unauthenticated Arbitrary Shortcode Execution
Ocean Extra
<= 2.4.6
CVE-2025-3472
6.5
Medium
stealthcopterYes
2025-04-21 00:00
Ocean Extra <= 2.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Ocean Extra
<= 2.4.6
CVE-2025-3457
6.4
Medium
Muhammad Yudha - DJYes
2024-07-04 00:00
Ocean Extra <= 2.2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
Ocean Extra
<= 2.2.9
CVE-2024-37489
6.4
Medium
wesley (wcraft)Yes
2024-06-10 20:23
Ocean Extra <= 2.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Flickr Widget
Ocean Extra
<= 2.2.8
CVE-2024-5531
6.4
Medium
wesley (wcraft)Yes
2024-04-08 00:00
Ocean Extra <= 2.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
Ocean Extra
<= 2.2.6
CVE-2024-3167
6.4
Medium
wesley (wcraft)Yes
Showing 1–10 of 21 reports

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C