CVE-2026-115592

HighCVSS 7.1

Published: 29/10/2026(UTC)Updated: 29/10/2026(UTC)Translated: 29/10/2026(UTC)NVD NIST

Summary

The OceanWP plugin for WordPress contains a Reflected XSS vulnerability due to improper neutralization of input during web page generation. The issue affects versions from n/a through 4.2.7.

Risk Assessment

An attacker can trick an administrator or user into clicking a crafted link, executing malicious script in the victim's browser context and potentially hijacking the session or performing actions on their behalf.

Recommendation

Update the OceanWP plugin to a version later than 4.2.7. Until then, avoid clicking unknown links pointing to the site.

Other vulnerabilities in OceanWP

CVE-2025-8944Medium
Vulnerability in OceanWP WordPress theme (before 4.1.2) due to a missing capability check on one of its AJAX request handlers, allowing any authenticated users, such as subscribers, to update the 'darkMod' setting.

Original NVD description (English source)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in OceanWP OceanWP oceanwp allows Reflected XSS.This issue affects OceanWP: from n/a through 4.2.7.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS