CVE-2025-9499
MediumCVSS 6.4Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
The Ocean Extra plugin for WordPress is vulnerable to stored XSS via the 'oceanwp_library' shortcode in versions up to and including 2.4.9 due to insufficient sanitization and escaping of user-supplied attributes. An authenticated attacker with Contributor-level access or higher can inject arbitrary scripts that execute when a user visits the page.
Risk Assessment
This allows an attacker to execute malicious code in the victim's browser, potentially leading to data theft or session hijacking.
Recommendation
Update the Ocean Extra plugin to a version above 2.4.9 and restrict editing privileges.
Other vulnerabilities in Ocean Extra
See all- CVE-2026-86803Medium
The Ocean Extra plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to and including 2.6.0. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
- CVE-2026-34903Medium
The Ocean Extra plugin for WordPress (through version 2.5.3) contains a Missing Authorization vulnerability that allows exploitation of incorrectly configured access control security levels.
Original NVD description (English source)
The Ocean Extra plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's oceanwp_library shortcode in all versions up to, and including, 2.4.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS