OceanWP has 5 CVEs on record between 2025 and 2026. 4 were published in the last 90 days. The busiest recent month was October 2026 with 3. The median CVSS is 6.5 (medium). None have a confirmed exploitation report. The most common weakness class is CWE-79 (3). Most affected products: oceanwp (2), Ocean Extra (1), Ocean Pro Demos (1).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 6.5
- Publish → KEV
- —
- Last 90 days
- 4 prev 0
Products
- oceanwp 2
- Ocean Extra 1
- Ocean Pro Demos 1
- ocean-extra 1
Worst active — by depth score
CVE-2026-81929High· 7.2The Ocean Pro Demos and Ocean eComm Treasure Box plugins for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content' parameter in all versions up to, and including, 1.5.4, and 1.8.0, respectively, due to insufficient aut…40CVE-2026-115592High· 7.1WordPress OceanWP theme <= 4.2.7 - Cross Site Scripting (XSS) vulnerability39CVE-2026-86803Medium· 6.5The The Ocean Extra plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.6.0 This is due to the software allowing users to execute an action that does not properly validate a value b…36CVE-2026-94684Medium· 6.5Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority36CVE-2025-8944Medium· 4.3The OceanWP WordPress theme before 4.1.2 is vulnerable to an option update due to a missing capability check on one of its AJAX request handler, allowing any authenticated users, such as subscriber to update the darkMod` setting.24
OceanWP vulnerabilities
CVEs affecting OceanWP, newest first. Open any entry for full detail, references, and exploit status.
5 CVEsRSS
CVE-2026-115592High· 7.1WordPress OceanWP theme <= 4.2.7 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in OceanWP OceanWP oceanwp allows Reflected XSS.This issue affects OceanWP: from n/a through 4.2.7.
CVE-2026-86803Medium· 6.5The The Ocean Extra plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.6.0 This is due to the software allowing users to execute an action that does not properly validate a value b…
The The Ocean Extra plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.6.0 This is due to the software allowing users to execute an action that does not properly validate a value b…
CVE-2026-81929High· 7.2The Ocean Pro Demos and Ocean eComm Treasure Box plugins for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content' parameter in all versions up to, and including, 1.5.4, and 1.8.0, respectively, due to insufficient aut…
The Ocean Pro Demos and Ocean eComm Treasure Box plugins for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content' parameter in all versions up to, and including, 1.5.4, and 1.8.0, respectively, due to insufficient aut…
CVE-2026-94684Medium· 6.5Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. False positive detection.
CVE-2025-8944Medium· 4.3The OceanWP WordPress theme before 4.1.2 is vulnerable to an option update due to a missing capability check on one of its AJAX request handler, allowing any authenticated users, such as subscriber to update the darkMod` setting.
The OceanWP WordPress theme before 4.1.2 is vulnerable to an option update due to a missing capability check on one of its AJAX request handler, allowing any authenticated users, such as subscriber to update the darkMod` setting.