Oceanwp

Ocean Extra

17 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
4.3

CVE-2020-36760

Exploit
  • EPSS 0.11%
  • Veröffentlicht 12.07.2023 08:15:09
  • Zuletzt bearbeitet 21.11.2024 05:30:14

The Ocean Extra plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.6.5]. This is due to missing or incorrect nonce validation on the add_core_extensions_bundle_validation() function. This makes it pos...

5.4

CVE-2023-23891

  • EPSS 0.1%
  • Veröffentlicht 06.04.2023 14:15:07
  • Zuletzt bearbeitet 21.11.2024 07:47:02

Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in OceanWP Ocean Extra plugin <= 2.1.1 versions. Needs the OceanWP theme installed and activated.

5.4

CVE-2023-24399

  • EPSS 0.13%
  • Veröffentlicht 30.03.2023 12:15:07
  • Zuletzt bearbeitet 21.11.2024 07:47:47

Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in OceanWP Ocean Extra plugin <= 2.1.2 versions.

6.5

CVE-2023-0749

Exploit
  • EPSS 0.3%
  • Veröffentlicht 13.03.2023 17:15:12
  • Zuletzt bearbeitet 27.02.2025 21:15:16

The Ocean Extra WordPress plugin before 2.1.3 does not ensure that the template to be loaded via a shortcode is actually a template, allowing any authenticated users such as subscriber to retrieve the content of arbitrary posts, such as draft, privat...

7.2

CVE-2022-3374

Exploit
  • EPSS 0.86%
  • Veröffentlicht 31.10.2022 16:15:11
  • Zuletzt bearbeitet 06.05.2025 21:15:53

The Ocean Extra WordPress plugin before 2.0.5 unserialises the content of an imported file, which could lead to PHP object injections issues when a high privilege user import (intentionally or not) a malicious Customizer Styling file and a suitable g...

6.1

CVE-2021-25104

Exploit
  • EPSS 3.38%
  • Veröffentlicht 20.06.2022 11:15:08
  • Zuletzt bearbeitet 21.11.2024 05:54:21

The Ocean Extra WordPress plugin before 1.9.5 does not escape generated links which are then used when the OceanWP is active, leading to a Reflected Cross-Site Scripting issue

7.5

CVE-2019-16250

Exploit
  • EPSS 0.4%
  • Veröffentlicht 11.09.2019 23:15:14
  • Zuletzt bearbeitet 21.11.2024 04:30:23

includes/wizard/wizard.php in the Ocean Extra plugin through 1.5.8 for WordPress allows unauthenticated options changes and injection of a Cascading Style Sheets (CSS) token sequence.