Unknown Ocean Extra vulnerabilities

3 vulnerabilities

Known vulnerabilities in Unknown Ocean Extra, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

6.1CVE-2021-25104oceanwpocean extra+2
EPSS score
1.44%
The Ocean Extra WordPress plugin before 1.9.5 does not escape generated links which are then used when the OceanWP is active, leading to a Reflected Cross-Site Scripting issue7.2CVE-2022-3374oceanwpocean extra+2
EPSS score
1.22%
The Ocean Extra WordPress plugin before 2.0.5 unserialises the content of an imported file, which could lead to PHP object injections issues when a high privilege user import (intentionally or not) a malicious Customizer Styling file and a suitable gadget chain is present on the blog.6.5CVE-2023-0749oceanwpocean extra+2
EPSS score
0.65%
The Ocean Extra WordPress plugin before 2.1.3 does not ensure that the template to be loaded via a shortcode is actually a template, allowing any authenticated users such as subscriber to retrieve the content of arbitrary posts, such as draft, private or even password protected ones.