Six vulnerabilities published for the OceanWP theme since 2020, only one of high severity, and twenty for Ocean Extra, the plugin that comes with it on most sites. This report clearly separates the two, explains why the companion plugin weighs more than the theme in the tally, and gives the minimum versions to aim for as of June 13, 2026.
OceanWP in brief
OceanWP is a free theme released on wordpress.org in June 2017 by OceanWP LLC. Versatile and compatible with Elementor, Gutenberg and WooCommerce, it has more than 400,000 active installations (wordpress.org). Its business model relies on plugins: a free plugin, Ocean Extra, also installed on more than 400,000 sites, and a series of official plugins, free or paid (social sharing, modal windows, product sharing, premium extension bundle).
This split matters. A theme is mostly a set of templates that display content; the features that receive data tend to live in the companion plugin. Ocean Extra, which "only works with the OceanWP theme" according to its plugin page, adds header and footer templates, per-page settings, demo import, widgets, mega menus, shortcodes (breadcrumbs, logged-in user, WooCommerce cart) and Customizer settings import. Every shortcode and every widget is one more input to filter.
This popularity makes OceanWP a uniform target: the same vulnerability is replicated identically on hundreds of thousands of sites as long as they are not updated.
Timeline of vulnerabilities from 2020 to June 2026
The OceanWP theme: six vulnerabilities
The table lists the theme's vulnerabilities published from January 1, 2020 to June 13, 2026 according to Patchstack (WPScan lists five, without the 2023 one), cross-checked with the CVE records. The CVSS score is the one from the authority that assigned the CVE. None is documented as exploited.
| Published | Fixed in | Type | CVSS | CVE | Account required |
|---|---|---|---|---|---|
| February 27, 2023 | 3.4.2 | Local file inclusion (theme panel) | 7.6 (Patchstack) | CVE-2023-23700 | Subscriber |
| March 28, 2024 | 3.5.5 | Missing authorization, sensitive data exposure | 4.3 | CVE-2024-2476 | Subscriber |
| June 18, 2025 | 4.1.0 | Stored XSS (Select HTML tag) | 4.9 | CVE-2025-5524 | Contributor |
| July 2, 2025 | 3.6.1 | Stored XSS via the Magnific Popup library | 6.4 | CVE-2024-5647 | Contributor |
| August 12, 2025 | 4.1.2 (affected: 4.0.9 to 4.1.1) | CSRF leading to the installation of Ocean Extra | 4.3 | CVE-2025-8891 | None (administrator tricked) |
| August 15, 2025 | 4.1.2 | Missing authorization (dark mode option) | 4.3 (WPScan) | CVE-2025-8944 | Subscriber |
Ocean Extra, the companion plugin: twenty vulnerabilities
Ocean Extra is updated separately, from Plugins. WPScan attributes 20 vulnerabilities published from January 1, 2020 to June 13, 2026 to it (Patchstack counts 21, because it splits a 2022 issue in two). Three come from the Freemius SDK, a licensing library bundled with hundreds of plugins: they are labeled "SDK".
| Published | Fixed in | Type | CVSS | CVE | Account required |
|---|---|---|---|---|---|
| September 16, 2020 | 1.6.6 | CSRF | 4.3 | CVE-2020-36760 | None (administrator tricked) |
| February 28, 2022 | 1.9.4 | SDK: missing authorization | 6.3 | CVE-2022-4974 | Logged in |
| May 24, 2022 | 1.9.5 | Reflected XSS | 6.1 (WPScan) | CVE-2021-25104 | None (click on a link) |
| October 10, 2022 | 2.0.5 | PHP object injection (style import) | 5.5 (WPScan) | CVE-2022-3374 | Administrator |
| February 2, 2023 | 2.1.2 | Stored XSS (breadcrumb shortcode) | 5.5 (Patchstack) | CVE-2023-23891 | Contributor |
| February 14, 2023 | 2.1.3 | Stored XSS (search shortcode) | 5.5 (Patchstack) | CVE-2023-24399 | Contributor |
| February 14, 2023 | 2.1.3 | Reading private content | 6.5 | CVE-2023-0749 | Subscriber |
| July 18, 2023 | 2.1.8 | SDK: reflected XSS | 6.1 (WPScan) | none | None (click on a link) |
| November 28, 2023 | 2.2.3 | CSRF leading to plugin activation | 5.4 (Patchstack) | CVE-2023-49164 | None (administrator tricked) |
| February 16, 2024 | 2.2.5 | Stored XSS (custom fields) | 6.4 | CVE-2024-1277 | Contributor |
| April 8, 2024 | 2.2.7 | Stored XSS (social share widget) | 6.4 | CVE-2024-3167 | Contributor |
| June 10, 2024 | 2.2.9 | Stored XSS (Flickr widget) | 6.4 | CVE-2024-5531 | Contributor |
| July 4, 2024 | 2.3.0 | Stored XSS | 6.5 (Patchstack) | CVE-2024-37489 | Contributor |
| April 21, 2025 | 2.4.7 | Arbitrary shortcode execution | 6.5 (9.8 according to NVD) | CVE-2025-3472 | None |
| April 21, 2025 | 2.4.7 | Stored XSS (ocean_gallery_id) | 6.4 | CVE-2025-3458 | Contributor |
| April 21, 2025 | 2.4.7 | Stored XSS (oceanwp_icon shortcode) | 6.4 | CVE-2025-3457 | Contributor |
| June 2, 2025 | 2.4.9 | Stored XSS | 6.5 (Patchstack) | CVE-2025-49068 | Contributor |
| August 29, 2025 | 2.5.0 | Stored XSS (oceanwp_library shortcode) | 6.4 | CVE-2025-9499 | Contributor |
| April 7, 2026 | 2.5.4 | Broken access control | 5.4 (Patchstack) | CVE-2026-34903 | Subscriber |
| April 30, 2026 | 2.4.4 | SDK: DOM-based reflected XSS | 6.1 | CVE-2024-13362 | None (click on a link) |
The notable vulnerabilities explained
2023 and 2024: the theme panel open to subscribers
The theme's two most serious vulnerabilities affect the OceanWP admin panel, which is loaded through AJAX requests. In February 2023, Rafie Muhammad (Patchstack) showed that a mere subscriber could make the site include local files from the server (CVE-2023-23700, CVSS 7.6, the theme's only high-severity vulnerability), which can expose sensitive files. Reported on February 15, it was fixed on February 22 in 3.4.2 and published on February 27.
A year later, Craig Smith found that the load_theme_panel_pane function did not check permissions: a subscriber could read system information or API keys stored in the settings (CVE-2024-2476, CVSS 4.3). Wordfence report on March 18, 2024, version 3.5.5 on March 27, publication on March 28.
2025: four medium vulnerabilities in two months
Summer 2025 accounts for the rest of the theme's history. CVE-2025-5524 is a stored XSS: a contributor could slip JavaScript in through the dropdown script, which then ran for every visitor (see our article on XSS vulnerabilities). Reported by Asaf Mozes, it was fixed in 4.1.0 on June 17 and published the next day.
CVE-2024-5647 comes from elsewhere: Magnific Popup 1.1.0, a JavaScript library bundled with many themes and plugins. Wordfence notified vendors as early as June 2024 and only published the shared record on July 2, 2025; OceanWP had already updated the library in 3.6.1, on October 8, 2024.
In August, version 4.1.2 (August 11, 2025) fixed two vulnerabilities. Dmitrii Ignatyev (CleanTalk) reported on August 6 that the oceanwp_notice_button_click AJAX action, tied to the notice suggesting the installation of Ocean Extra, did not check an anti-CSRF token: according to the CVE-2025-8891 record, a logged-in administrator who clicks a booby-trapped link can have Ocean Extra installed without knowing it. And CVE-2025-8944 (WPScan, Hamit Cibo) let a subscriber change the dark mode setting.
Ocean Extra, April 2025: shortcodes executed without an account
The most notable vulnerability in the ecosystem is CVE-2025-3472. Up to version 2.4.6, an Ocean Extra action passed a received value to the do_shortcode function without validating it: on a site where WooCommerce is active, a logged-out visitor could run the shortcode of their choice. The severity depends on the shortcodes present on the site. Wordfence, the CVE authority, rated it 6.5; NIST's NVD database gives it 9.8. Reported by Matthew Rollings, it was one of three Wordfence reports from April 11, 2025, all fixed in 2.4.7 on April 21, the day of publication.
Ocean Extra: the other families of vulnerabilities
- Stored XSS: ten of the twenty vulnerabilities. A contributor inserts code into a shortcode or widget attribute (breadcrumbs, icon, gallery, Flickr, template library), and that code runs for every visitor, administrators included.
- Reading private content (CVE-2023-0749): the template shortcode did not check that the requested ID was actually a template. A subscriber could display any content, whether draft, private or password-protected. Reported by Erwan LR (WPScan), fixed in 2.1.3 on February 13, 2023.
- CSRF: in 2023, Dave Jong (Patchstack) showed that a booby-trapped link could make a logged-in administrator activate any installed plugin (CVE-2023-49164), fixed in 2.2.3 the day before publication.
- PHP object injection (CVE-2022-3374): importing a Customizer settings file unserialized its content. An administrator had to import a booby-trapped file: the mechanism is detailed in our article on PHP object injection.
- Access control (CVE-2026-34903): reported on January 27, 2026 by Nguyen Ba Khanh through Patchstack, fixed in version 2.5.4 of March 9 and published on April 7, 2026. Patchstack considers it low priority.
The other official Ocean plugins
One other official plugin deserves a mention. In Ocean Modal Window (more than 10,000 active installations), the display conditions of a modal window, which an editor can set, were passed to the PHP eval function: an editor account was enough to execute code on the server (CVE-2025-13307, CVSS 7.2 according to WPScan, researcher Alex Tselevich). Fixed in 2.3.3 on November 26, 2025, published on November 28. Ocean Social Sharing (more than 60,000 installations) had a stored XSS exploitable by a contributor (CVE-2025-7500, CVSS 6.4), fixed in 2.2.2 on July 22, 2025.
What this history shows
- The theme is lightly affected, the plugin more so: six vulnerabilities versus twenty over the same period. Judging OceanWP on the theme alone would be too flattering: on a real site, the two are installed together.
- Subscribers are a real risk: three theme vulnerabilities and two Ocean Extra vulnerabilities are exploitable with a mere subscriber account. On a WooCommerce site, every customer who creates an account is one.
- Quick fixes: when the dates are published, the vendor usually fixed the issue less than two weeks after receiving the report, and always before or on the day of the public announcement. Its changelog consistently credits the report (Wordfence, Patchstack, WPScan, CleanTalk) and its date.
- Third-party code matters too: three Ocean Extra vulnerabilities come from the Freemius SDK and one theme vulnerability from the Magnific Popup library. Updating the theme and the plugin also updates these bundled components.
This profile is nothing unusual: the timeline of WordPress core security releases shows that no software escapes patches. The difference lies in the delay between a fix being released and its installation.
How to protect your site
- Update the theme and the plugin separately: as of June 13, 2026, aim for at least OceanWP 4.1.2 and Ocean Extra 2.5.4. The theme is updated under Appearance, Ocean Extra under Plugins.
- Turn on automatic updates for the theme and Ocean Extra; our guide to automatic updates explains how to limit the risk of breakage.
- Delete unused Ocean plugins (see abandoned and unused plugins). If you have moved away from OceanWP, delete Ocean Extra too: it only works with that theme.
- Limit accounts: close public registration if you do not need it and keep the contributor and editor roles for the people who need them (roles and least privilege). On a store, customer accounts are unavoidable (see securing a WooCommerce store).
- Add a web application firewall to cover the gap between a vulnerability announcement and your update (our WordPress firewall comparison).
- Watch the advisories for the theme and every Ocean plugin, as described in our vulnerability monitoring method.
WP Masquerade Pro helps with that last point. Every day, it compares the installed versions of your plugins and themes with the public WPVulnerability.net database and sends you a vulnerability alert by email, with the severity and the fixed version. In the member area, monitoring your sites brings together pending updates and vulnerable sites. WP Masquerade alerts, it fixes neither the theme nor the plugin and it is not a firewall: updating remains the decisive step. To choose a firewall, see our comparison of the best WordPress security plugins.
Key takeaways
- The OceanWP theme has 6 vulnerabilities published from 2020 to June 13, 2026, only one of high severity (local file inclusion, 2023).
- Its companion plugin Ocean Extra has 20 over the same period, including unauthenticated shortcode execution in April 2025.
- None of these vulnerabilities is documented as exploited; when the dates are known, the fix was released before or on the day of the announcement.
- Minimum versions: OceanWP 4.1.2 and Ocean Extra 2.5.4; limit subscriber, contributor and editor accounts.
Sources
- WordPress.org: OceanWP theme, theme page and active installations (external link, opens in a new tab)
- OceanWP: OceanWP Theme Changelog (external link, opens in a new tab)
- CVE.org: CVE-2024-2476, OceanWP 3.5.4 and earlier (March 29, 2024) (external link, opens in a new tab)
- CVE.org: CVE-2025-5524, OceanWP 4.0.9 and earlier (June 19, 2025) (external link, opens in a new tab)
Other sources consulted: further CVE records, official vendor pages, security research publications, WPScan and Patchstack databases.
Update, October 28, 2026: on October 14, 2026, Wordfence disclosed CVE-2026-86803 in the Ocean Extra plugin up to 2.6.0: an unauthenticated visitor could get shortcodes executed. The 2.6.1 patch had been available since September 10. Full details: Ocean Extra unauthenticated vulnerability: patch 2.6.1 came first.
