OceanWP

OceanWP has 6 disclosed vulnerabilities in the WordSec catalog, reported between 2023 and 2025; all 6 are fixed as of September 2026. Their average CVSS score is 5.5, and the most serious one scores 8.8 out of 10. Severity breakdown: 0 critical and 1 high. 2025 was the busiest year with 4 disclosures.

The most common weakness is Cross-Site Scripting, behind 2 of the records (33%). Other recurring categories include Missing Authorization, Cross-Site Request Forgery (CSRF).

Every one of the 6 issues recorded for OceanWP has a vendor fix available, so running the current release closes all known holes.

5 independent researchers contributed these findings, most of them (2) reported by Webbernaut. OceanWP is installed on roughly 500,000 WordPress sites, so each unpatched flaw has a wide blast radius.

Strategic Overview

Avg CVSSMedium

5.5/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all OceanWP vulnerabilities before they are exploited.

Highest severity on recordCVSS 8.8CVE-2023-23700

OceanWP <= 3.4.1 - Authenticated (Subscriber+) Local File Inclusion

Read the full analysis

Vulnerability Records

6 records


2025-08-15 00:00	OceanWP <= 4.1.1 - Missing Authorization to Authenticated (Subscriber+) Settings Update OceanWP <= 4.1.1	`CVE-2025-8944`	4.3 Medium	Hamit Cibo	Yes
2025-08-12 00:00	OceanWP <= 4.0.9 - 4.1.1 - Cross-Site Request Forgery to Ocean Extra Plugin Installation OceanWP 4.0.9 – 4.1.1	`CVE-2025-8891`	4.3 Medium	Dmitrii Ignatyev	Yes
2025-07-02 00:00	Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Magnific Popups JavaScript Library OceanWP <= 3.6.0	`CVE-2024-5647`	6.4 Medium	Webbernaut	Yes
2025-06-18 16:22	OceanWP <= 4.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Select HTML Tag OceanWP <= 4.0.9	`CVE-2025-5524`	4.9 Medium	Asaf Mozes	Yes
2024-03-28 00:00	OceanWP <= 3.5.4 - Missing Authorization to Sensitive Information Exposure via Limited Local File Inclusion OceanWP <= 3.5.4	`CVE-2024-2476`	4.3 Medium	Webbernaut	Yes
2023-02-27 00:00	OceanWP <= 3.4.1 - Authenticated (Subscriber+) Local File Inclusion OceanWP <= 3.4.1	`CVE-2023-23700`	8.8 High	Rafie Muhammad	Yes

Showing 1–6 of 6 reports

Latestv4.2.4

OceanWP

Author

oceanwp

4.9(5,714)

98/100

Last Updated

2026-08-31 (13d ago)

Active Installs

500,000+

Downloads

9,949,048

Requires WP

5.9+

Requires PHP

7.4+

Created

2017-06-12 (9y ago)

OceanWP is the perfect theme for your project. Lightweight and highly extendable, it will enable you to create almost any type of website such a blog, portfolio, business website and WooCommerce storefront with a beautiful & professional design. Very fast, responsive, RTL & translation ready, best SEO practices, unique WooCommerce features to increase conversion and much more. You can even edit the settings on tablet & mobile so your site looks good on every device. Work with the most popular page builders as Elementor, Beaver Builder, Brizy, Visual Composer, Divi, SiteOrigin, etc... Developers will love his extensible codebase making it a joy to customize and extend. Best friend of Elementor & WooCommerce. Looking for a Multi-Purpose theme? Look no further! Check the demos to realize that it's the only theme you will ever need: https://oceanwp.org/demos/