Oceanwp: >> Ocean Extra >> 1.0.0 Security Vulnerabilities
The Ocean Extra WordPress plugin before 2.1.3 does not ensure that the template to be loaded via a shortcode is actually a template, allowing any authenticated users such as subscriber to retrieve the content of arbitrary posts, such as draft, private or even password protected ones.
CVSS Score
6.5
EPSS Score
0.003
Published
2023-03-13
The Ocean Extra WordPress plugin before 2.0.5 unserialises the content of an imported file, which could lead to PHP object injections issues when a high privilege user import (intentionally or not) a malicious Customizer Styling file and a suitable gadget chain is present on the blog.
CVSS Score
7.2
EPSS Score
0.002
Published
2022-10-31
The Ocean Extra WordPress plugin before 1.9.5 does not escape generated links which are then used when the OceanWP is active, leading to a Reflected Cross-Site Scripting issue
CVSS Score
6.1
EPSS Score
0.034
Published
2022-06-20
includes/wizard/wizard.php in the Ocean Extra plugin through 1.5.8 for WordPress allows unauthenticated options changes and injection of a Cascading Style Sheets (CSS) token sequence.
CVSS Score
7.5
EPSS Score
0.004
Published
2019-09-11
Page 2