Vulnerabilities (CVE)

Join the Common Vulnerabilities and Exposures (CVE) community and start to get notified about new vulnerabilities.

Filtered by vendor Oceanwp Subscribe
Total 5 CVE
CVE Vendors Products Updated CVSS v2 CVSS v3
CVE-2023-0749 1 Oceanwp 1 Ocean Extra 2023-03-16 N/A 6.5 MEDIUM
The Ocean Extra WordPress plugin before 2.1.3 does not ensure that the template to be loaded via a shortcode is actually a template, allowing any authenticated users such as subscriber to retrieve the content of arbitrary posts, such as draft, private or even password protected ones.
CVE-2022-35730 1 Oceanwp 1 Sticky Header 2022-12-06 N/A 6.5 MEDIUM
Cross-Site Request Forgery (CSRF) vulnerability in Oceanwp sticky header plugin <= 1.0.8 on WordPress.
CVE-2022-3374 1 Oceanwp 1 Ocean Extra 2022-11-01 N/A 7.2 HIGH
The Ocean Extra WordPress plugin before 2.0.5 unserialises the content of an imported file, which could lead to PHP object injections issues when a high privilege user import (intentionally or not) a malicious Customizer Styling file and a suitable gadget chain is present on the blog.
CVE-2021-25104 1 Oceanwp 1 Ocean Extra 2022-06-30 4.3 MEDIUM 6.1 MEDIUM
The Ocean Extra WordPress plugin before 1.9.5 does not escape generated links which are then used when the OceanWP is active, leading to a Reflected Cross-Site Scripting issue
CVE-2019-16250 1 Oceanwp 1 Ocean Extra 2020-08-24 5.0 MEDIUM 7.5 HIGH
includes/wizard/wizard.php in the Ocean Extra plugin through 1.5.8 for WordPress allows unauthenticated options changes and injection of a Cascading Style Sheets (CSS) token sequence.