ocean_extra 漏洞

中危CVE-2025-34722026/01/30

Ocean Extra <= 2.4.6 - Unauthenticated Shortcode Execution

The Ocean Extra plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.4.6. This is due to the software allowing users to supply arbitrary shortcodes in the content_rech_data parameter that is then executed. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes when WooCommerce is also installed and activated.

ocean_extraPoC 已收录

CVSS—

中危CVE-2021-251042022/06/20

WordPress Ocean Extra <1.9.5 - Cross-Site Scripting

WordPress Ocean Extra plugin before 1.9.5 contains a cross-site scripting vulnerability. The plugin does not escape generated links which are then used when the OceanWP theme is active.

ocean_extraPoC 已收录

CVSS6.1EPSS 3.4%

ocean_extra

关联漏洞

Ocean Extra <= 2.4.6 - Unauthenticated Shortcode Execution

WordPress Ocean Extra <1.9.5 - Cross-Site Scripting