GCVE - cpe:2.3:a:oceanwp:oceanwp:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:oceanwp:oceanwp:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Oceanwp (`1270c509-879e-5115-bf5d-db406c71e90a`)
Product	Oceanwp (`b0877ca4-e429-584a-adca-002b1b3d9ff4`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:github/oceanwp/oceanwp`	purl2cpe	2026-06-01 10:18:18.287018

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2025-8891`	vulnerable	2026-06-08 07:45:21.366940	OceanWP <= 4.0.9 - 4.1.1 - Cross-Site Request Forgery to Ocean Extra Plugin Installation MEDIUM (4.3) The OceanWP theme for WordPress is vulnerable to Cross-Site Request Forgery in versions 4.0.9 to 4.1.1. This is due to missing or incorrect nonce validation on the oceanwp_notice_button_click() function. This makes it possible for unauthenticated attackers to install the Ocean Extra plugin via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Published: 2025-08-13T03:42:03.487Z Updated: 2025-08-26T15:16:23.274Z Open on db.gcve.eu Reference links https://www.wordfence.com/threat-intel/vulnerabilities/id/9c6f9a3d-54a6-4405-b42b-37fc8342af96?source=cve https://themes.trac.wordpress.org/changeset/283264/oceanwp/4.1.2/inc/activation-notice/api.php https://research.cleantalk.org/cve-2025-8891/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-5524`	vulnerable	2026-06-08 07:37:25.094955	OceanWP <= 4.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Select HTML Tag MEDIUM (4.9) The OceanWP theme for WordPress is vulnerable to Stored Cross-Site Scripting via the Select HTML tag in all versions up to, and including, 4.0.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Published: 2025-06-19T04:25:19.424Z Updated: 2026-04-08T16:46:24.626Z Open on db.gcve.eu Reference links https://www.wordfence.com/threat-intel/vulnerabilities/id/37b085f9-3b15-44aa-9ba0-de5321dfbce4?source=cve https://themes.trac.wordpress.org/browser/oceanwp/4.0.9/assets/js/select.min.js https://themes.trac.wordpress.org/changeset/276114/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-5647`	vulnerable	2026-06-08 06:56:16.860437	Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Magnific Popups JavaScript Library MEDIUM (6.4) Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled Magnific Popups library (version 1.1.0) in various versions due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. NOTE: This vulnerability was fixed in the upstream library (Magnific Popups version 1.2.0) by disabling the loading of HTML within certain fields by default. Published: 2025-07-03T09:22:19.308Z Updated: 2026-08-25T19:06:26.772Z Open on db.gcve.eu Reference links https://www.wordfence.com/threat-intel/vulnerabilities/id/dae80fc2-3076-4a32-876d-5df1c62de9bd?source=cve https://plugins.trac.wordpress.org/browser/shortcodes-ultimate/trunk/vendor/magnific-popup/magnific-popup.js https://plugins.trac.wordpress.org/browser/essential-addons-for-elementor-lite/trunk/assets/front-end/js/lib-view/magnific-popup/jquery.magnific-popup.js https://plugins.trac.wordpress.org/browser/bold-page-builder/trunk/content_elements_misc/js/jquery.magnific-popup.js https://plugins.trac.wordpress.org/changeset/3154460/happy-elementor-addons	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-2476`	vulnerable	2026-06-08 06:33:31.197184	OceanWP <= 3.5.4 - Missing Authorization to Sensitive Information Exposure via Limited Local File Inclusion MEDIUM (4.3) The OceanWP theme for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the load_theme_panel_pane function in all versions up to, and including, 3.5.4. This makes it possible for authenticated attackers, with subscriber-level access and above, to expose sensitive information such as system/environment data and API keys. Published: 2024-03-29T06:44:00.109Z Updated: 2026-04-08T16:56:14.340Z Open on db.gcve.eu Reference links https://www.wordfence.com/threat-intel/vulnerabilities/id/5ec2743d-0d96-4056-8fdf-dc81d4e9b76f?source=cve https://themes.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=222387%40oceanwp&new=222387%40oceanwp&sfp_email=&sfph_mail=	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-23700`	vulnerable	2026-06-08 05:56:04.280100	WordPress OceanWP theme <= 3.4.1 - Authenticated Local File Inclusion vulnerability HIGH (7.6) Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in OceanWP allows PHP Local File Inclusion.This issue affects OceanWP: from n/a through 3.4.1. Published: 2024-05-17T06:30:56.893Z Updated: 2026-04-28T16:08:00.828Z Open on db.gcve.eu Reference links https://patchstack.com/database/vulnerability/oceanwp/wordpress-oceanwp-theme-3-4-1-authenticated-local-file-inclusion-vulnerability?_s_id=cve	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.