--- title: "OceanWP theme: vulnerability history and patches" description: "The 6 vulnerabilities in the OceanWP theme and the 20 in its Ocean Extra plugin since 2020: affected versions, patches, fix times and protections." language: "en" locale: "en-US" type: "article" canonical: "https://www.wp-masquerade.com/oceanwp-theme-security-vulnerabilities/" published: "2026-06-16T07:00:00+00:00" modified: "2026-10-29T07:36:38+00:00" translations: en-US: "https://www.wp-masquerade.com/oceanwp-theme-security-vulnerabilities/index.md" fr-FR: "https://www.wp-masquerade.com/fr/failles-securite-theme-oceanwp/index.md" es-ES: "https://www.wp-masquerade.com/es/vulnerabilidades-tema-oceanwp/index.md" de-DE: "https://www.wp-masquerade.com/de/oceanwp-theme-sicherheitsluecken/index.md" it-IT: "https://www.wp-masquerade.com/it/vulnerabilita-sicurezza-tema-oceanwp/index.md" pt-BR: "https://www.wp-masquerade.com/pt/vulnerabilidades-seguranca-tema-oceanwp/index.md" nl-NL: "https://www.wp-masquerade.com/nl/oceanwp-thema-kwetsbaarheden-beveiliging/index.md" --- # OceanWP theme: vulnerability history and patches Six vulnerabilities for the OceanWP theme since 2020, twenty for its companion plugin Ocean Extra: timeline, notable vulnerabilities, fixed versions and protections. Six vulnerabilities published for the OceanWP theme since 2020, only one of high severity, and twenty for Ocean Extra, the plugin that comes with it on most sites. This report clearly separates the two, explains why the companion plugin weighs more than the theme in the tally, and gives the minimum versions to aim for as of June 13, 2026. ## OceanWP in brief OceanWP is a free theme released on wordpress.org in June 2017 by OceanWP LLC. Versatile and compatible with Elementor, Gutenberg and WooCommerce, it has more than 400,000 active installations (wordpress.org). Its business model relies on plugins: a free plugin, Ocean Extra, also installed on more than 400,000 sites, and a series of official plugins, free or paid (social sharing, modal windows, product sharing, premium extension bundle). This split matters. A theme is mostly a set of templates that display content; the features that receive data tend to live in the companion plugin. Ocean Extra, which "only works with the OceanWP theme" according to its plugin page, adds header and footer templates, per-page settings, demo import, widgets, mega menus, shortcodes (breadcrumbs, logged-in user, WooCommerce cart) and Customizer settings import. Every shortcode and every widget is one more input to filter. This popularity makes OceanWP a uniform target: the same vulnerability is replicated identically on hundreds of thousands of sites as long as they are not updated. ## Timeline of vulnerabilities from 2020 to June 2026 ![Timeline: October 10, 2022, PHP object injection in Ocean Extra fixed in 2.0.5; February 14, 2023, private content readable by a subscriber in Ocean Extra, fixed in 2.1.3; February 27, 2023, local file inclusion in the theme, high severity, fixed in 3.4.2; November 28, 2023, plugin activation via CSRF in Ocean Extra, fixed in 2.2.3; March 28, 2024, sensitive theme panel data exposed to a subscriber, fixed in 3.5.5; April 21, 2025, unauthenticated shortcode execution in Ocean Extra with WooCommerce, fixed in 2.4.7; June 18, July 2, August 12 and 15, 2025, four medium-severity vulnerabilities in the theme fixed in 4.1.0, 3.6.1 and 4.1.2; November 28, 2025, code execution by an editor in Ocean Modal Window, fixed in 2.3.3; April 7, 2026, broken access control in Ocean Extra, fixed in 2.5.4.](https://www.wp-masquerade.com/media/2026/10/chronologie-failles-oceanwp-en.webp) *Dates are the publication dates of each vulnerability. The prefix shows the affected product: theme, Ocean Extra or another official plugin.* ### The OceanWP theme: six vulnerabilities The table lists the theme's vulnerabilities published from January 1, 2020 to June 13, 2026 according to Patchstack (WPScan lists five, without the 2023 one), cross-checked with the [CVE](https://www.wp-masquerade.com/glossary/cve/) records. The [CVSS score](https://www.wp-masquerade.com/glossary/cvss/) is the one from the authority that assigned the CVE. None is documented as exploited. | Published | Fixed in | Type | CVSS | CVE | Account required | | --- | --- | --- | --- | --- | --- | | February 27, 2023 | 3.4.2 | Local file inclusion (theme panel) | 7.6 (Patchstack) | CVE-2023-23700 | Subscriber | | March 28, 2024 | 3.5.5 | Missing authorization, sensitive data exposure | 4.3 | CVE-2024-2476 | Subscriber | | June 18, 2025 | 4.1.0 | Stored XSS (Select HTML tag) | 4.9 | CVE-2025-5524 | Contributor | | July 2, 2025 | 3.6.1 | Stored XSS via the Magnific Popup library | 6.4 | CVE-2024-5647 | Contributor | | August 12, 2025 | 4.1.2 (affected: 4.0.9 to 4.1.1) | CSRF leading to the installation of Ocean Extra | 4.3 | CVE-2025-8891 | None (administrator tricked) | | August 15, 2025 | 4.1.2 | Missing authorization (dark mode option) | 4.3 (WPScan) | CVE-2025-8944 | Subscriber | *OceanWP theme: 6 vulnerabilities published between 2020 and June 13, 2026 (sources: Patchstack, WPScan, CVE records; Wordfence score unless stated).* ### Ocean Extra, the companion plugin: twenty vulnerabilities Ocean Extra is updated separately, from Plugins. WPScan attributes 20 vulnerabilities published from January 1, 2020 to June 13, 2026 to it (Patchstack counts 21, because it splits a 2022 issue in two). Three come from the Freemius SDK, a licensing library bundled with hundreds of plugins: they are labeled "SDK". | Published | Fixed in | Type | CVSS | CVE | Account required | | --- | --- | --- | --- | --- | --- | | September 16, 2020 | 1.6.6 | CSRF | 4.3 | CVE-2020-36760 | None (administrator tricked) | | February 28, 2022 | 1.9.4 | SDK: missing authorization | 6.3 | CVE-2022-4974 | Logged in | | May 24, 2022 | 1.9.5 | Reflected XSS | 6.1 (WPScan) | CVE-2021-25104 | None (click on a link) | | October 10, 2022 | 2.0.5 | PHP object injection (style import) | 5.5 (WPScan) | CVE-2022-3374 | Administrator | | February 2, 2023 | 2.1.2 | Stored XSS (breadcrumb shortcode) | 5.5 (Patchstack) | CVE-2023-23891 | Contributor | | February 14, 2023 | 2.1.3 | Stored XSS (search shortcode) | 5.5 (Patchstack) | CVE-2023-24399 | Contributor | | February 14, 2023 | 2.1.3 | Reading private content | 6.5 | CVE-2023-0749 | Subscriber | | July 18, 2023 | 2.1.8 | SDK: reflected XSS | 6.1 (WPScan) | none | None (click on a link) | | November 28, 2023 | 2.2.3 | CSRF leading to plugin activation | 5.4 (Patchstack) | CVE-2023-49164 | None (administrator tricked) | | February 16, 2024 | 2.2.5 | Stored XSS (custom fields) | 6.4 | CVE-2024-1277 | Contributor | | April 8, 2024 | 2.2.7 | Stored XSS (social share widget) | 6.4 | CVE-2024-3167 | Contributor | | June 10, 2024 | 2.2.9 | Stored XSS (Flickr widget) | 6.4 | CVE-2024-5531 | Contributor | | July 4, 2024 | 2.3.0 | Stored XSS | 6.5 (Patchstack) | CVE-2024-37489 | Contributor | | April 21, 2025 | 2.4.7 | Arbitrary shortcode execution | 6.5 (9.8 according to NVD) | CVE-2025-3472 | None | | April 21, 2025 | 2.4.7 | Stored XSS (ocean_gallery_id) | 6.4 | CVE-2025-3458 | Contributor | | April 21, 2025 | 2.4.7 | Stored XSS (oceanwp_icon shortcode) | 6.4 | CVE-2025-3457 | Contributor | | June 2, 2025 | 2.4.9 | Stored XSS | 6.5 (Patchstack) | CVE-2025-49068 | Contributor | | August 29, 2025 | 2.5.0 | Stored XSS (oceanwp_library shortcode) | 6.4 | CVE-2025-9499 | Contributor | | April 7, 2026 | 2.5.4 | Broken access control | 5.4 (Patchstack) | CVE-2026-34903 | Subscriber | | April 30, 2026 | 2.4.4 | SDK: DOM-based reflected XSS | 6.1 | CVE-2024-13362 | None (click on a link) | *Ocean Extra plugin: 20 vulnerabilities published between 2020 and June 13, 2026 (sources: WPScan, Patchstack, CVE records; Wordfence score unless stated).* ## The notable vulnerabilities explained ### 2023 and 2024: the theme panel open to subscribers The theme's two most serious vulnerabilities affect the OceanWP admin panel, which is loaded through AJAX requests. In February 2023, Rafie Muhammad (Patchstack) showed that a mere subscriber could make the site include local files from the server (CVE-2023-23700, CVSS 7.6, the theme's only high-severity vulnerability), which can expose sensitive files. Reported on February 15, it was fixed on February 22 in 3.4.2 and published on February 27. A year later, Craig Smith found that the `load_theme_panel_pane` function did not check permissions: a subscriber could read system information or API keys stored in the settings (CVE-2024-2476, CVSS 4.3). Wordfence report on March 18, 2024, version 3.5.5 on March 27, publication on March 28. ### 2025: four medium vulnerabilities in two months Summer 2025 accounts for the rest of the theme's history. CVE-2025-5524 is a stored [XSS](https://www.wp-masquerade.com/glossary/xss/): a contributor could slip JavaScript in through the dropdown script, which then ran for every visitor (see our article on XSS vulnerabilities). Reported by Asaf Mozes, it was fixed in 4.1.0 on June 17 and published the next day. CVE-2024-5647 comes from elsewhere: Magnific Popup 1.1.0, a JavaScript library bundled with many themes and plugins. Wordfence notified vendors as early as June 2024 and only published the shared record on July 2, 2025; OceanWP had already updated the library in 3.6.1, on October 8, 2024. In August, version 4.1.2 (August 11, 2025) fixed two vulnerabilities. Dmitrii Ignatyev (CleanTalk) reported on August 6 that the `oceanwp_notice_button_click` AJAX action, tied to the notice suggesting the installation of Ocean Extra, did not check an anti-CSRF token: according to the CVE-2025-8891 record, a logged-in administrator who clicks a booby-trapped link can have Ocean Extra installed without knowing it. And CVE-2025-8944 (WPScan, Hamit Cibo) let a subscriber change the dark mode setting. ### Ocean Extra, April 2025: shortcodes executed without an account The most notable vulnerability in the ecosystem is CVE-2025-3472. Up to version 2.4.6, an Ocean Extra action passed a received value to the `do_shortcode` function without validating it: on a site where WooCommerce is active, a logged-out visitor could run the shortcode of their choice. The severity depends on the shortcodes present on the site. Wordfence, the CVE authority, rated it 6.5; NIST's NVD database gives it 9.8. Reported by Matthew Rollings, it was one of three Wordfence reports from April 11, 2025, all fixed in 2.4.7 on April 21, the day of publication. ### Ocean Extra: the other families of vulnerabilities - **Stored XSS**: ten of the twenty vulnerabilities. A contributor inserts code into a shortcode or widget attribute (breadcrumbs, icon, gallery, Flickr, template library), and that code runs for every visitor, administrators included. - **Reading private content** (CVE-2023-0749): the template shortcode did not check that the requested ID was actually a template. A subscriber could display any content, whether draft, private or password-protected. Reported by Erwan LR (WPScan), fixed in 2.1.3 on February 13, 2023. - **CSRF**: in 2023, Dave Jong (Patchstack) showed that a booby-trapped link could make a logged-in administrator activate any installed plugin (CVE-2023-49164), fixed in 2.2.3 the day before publication. - **PHP object injection** (CVE-2022-3374): importing a Customizer settings file unserialized its content. An administrator had to import a booby-trapped file: the mechanism is detailed in [our article on PHP object injection](https://www.wp-masquerade.com/php-deserialization-object-injection/). - **Access control** (CVE-2026-34903): reported on January 27, 2026 by Nguyen Ba Khanh through Patchstack, fixed in version 2.5.4 of March 9 and published on April 7, 2026. Patchstack considers it low priority. ![Bar chart of vulnerabilities published per year for Ocean Extra, according to WPScan: 1 in 2020, 0 in 2021, 3 in 2022, 5 in 2023, 4 in 2024, 5 in 2025 and 2 in 2026 up to June 13, for a total of 20 vulnerabilities, all medium severity except one high-severity vulnerability in 2026.](https://www.wp-masquerade.com/media/2026/10/failles-par-annee-ocean-extra-en.webp) *WPScan database, January 1, 2020 to June 13, 2026, with the score shown by WPScan. The theme is not counted.* ### The other official Ocean plugins One other official plugin deserves a mention. In Ocean Modal Window (more than 10,000 active installations), the display conditions of a modal window, which an editor can set, were passed to the PHP `eval` function: an editor account was enough to execute code on the server (CVE-2025-13307, CVSS 7.2 according to WPScan, researcher Alex Tselevich). Fixed in 2.3.3 on November 26, 2025, published on November 28. Ocean Social Sharing (more than 60,000 installations) had a stored XSS exploitable by a contributor (CVE-2025-7500, CVSS 6.4), fixed in 2.2.2 on July 22, 2025. ## What this history shows - **The theme is lightly affected, the plugin more so**: six vulnerabilities versus twenty over the same period. Judging OceanWP on the theme alone would be too flattering: on a real site, the two are installed together. - **Subscribers are a real risk**: three theme vulnerabilities and two Ocean Extra vulnerabilities are exploitable with a mere subscriber account. On a WooCommerce site, every customer who creates an account is one. - **Quick fixes**: when the dates are published, the vendor usually fixed the issue less than two weeks after receiving the report, and always before or on the day of the public announcement. Its changelog consistently credits the report (Wordfence, Patchstack, WPScan, CleanTalk) and its date. - **Third-party code matters too**: three Ocean Extra vulnerabilities come from the Freemius SDK and one theme vulnerability from the Magnific Popup library. Updating the theme and the plugin also updates these bundled components. This profile is nothing unusual: [the timeline of WordPress core security releases](https://www.wp-masquerade.com/wordpress-core-vulnerabilities-timeline/) shows that no software escapes patches. The difference lies in the delay between a fix being released and its installation. ## How to protect your site - **Update the theme and the plugin separately**: as of June 13, 2026, aim for at least OceanWP 4.1.2 and Ocean Extra 2.5.4. The theme is updated under Appearance, Ocean Extra under Plugins. - **Turn on automatic updates** for the theme and Ocean Extra; our guide to automatic updates explains how to limit the risk of breakage. - **Delete unused Ocean plugins** (see abandoned and unused plugins). If you have moved away from OceanWP, delete Ocean Extra too: it only works with that theme. - **Limit accounts**: close public registration if you do not need it and keep the contributor and editor roles for the people who need them (roles and least privilege). On a store, customer accounts are unavoidable (see securing a WooCommerce store). - **Add a web application firewall** to cover the gap between a vulnerability announcement and your update (our WordPress firewall comparison). - **Watch the advisories** for the theme and every Ocean plugin, as described in our vulnerability monitoring method. WP Masquerade Pro helps with that last point. Every day, it compares the installed versions of your plugins and themes with the public WPVulnerability.net database and sends you a [vulnerability alert](https://www.wp-masquerade.com/features/vulnerable-plugin-alerts/) by [email](https://www.wp-masquerade.com/features/email-alerts/), with the severity and the fixed version. In the member area, [monitoring your sites](https://www.wp-masquerade.com/features/#surveillance) brings together pending updates and vulnerable sites. WP Masquerade alerts, it fixes neither the theme nor the plugin and it is not a firewall: updating remains the decisive step. To choose a firewall, see our [comparison of the best WordPress security plugins](https://www.wp-masquerade.com/best-wordpress-security-plugins/). ### Key takeaways - The OceanWP theme has 6 vulnerabilities published from 2020 to June 13, 2026, only one of high severity (local file inclusion, 2023). - Its companion plugin Ocean Extra has 20 over the same period, including unauthenticated shortcode execution in April 2025. - None of these vulnerabilities is documented as exploited; when the dates are known, the fix was released before or on the day of the announcement. - Minimum versions: OceanWP 4.1.2 and Ocean Extra 2.5.4; limit subscriber, contributor and editor accounts. ## Sources - WordPress.org: OceanWP theme, theme page and active installations (https://wordpress.org/themes/oceanwp/) - OceanWP: OceanWP Theme Changelog (https://docs.oceanwp.org/article/653-oceanwp-theme-changelog) - CVE.org: CVE-2024-2476, OceanWP 3.5.4 and earlier (March 29, 2024) (https://www.cve.org/CVERecord?id=CVE-2024-2476) - CVE.org: CVE-2025-5524, OceanWP 4.0.9 and earlier (June 19, 2025) (https://www.cve.org/CVERecord?id=CVE-2025-5524) Other sources consulted: further CVE records, official vendor pages, security research publications, WPScan and Patchstack databases. **Update, October 28, 2026:** on October 14, 2026, Wordfence disclosed CVE-2026-86803 in the Ocean Extra plugin up to 2.6.0: an unauthenticated visitor could get shortcodes executed. The 2.6.1 patch had been available since September 10. Full details: [Ocean Extra unauthenticated vulnerability: patch 2.6.1 came first](https://www.wp-masquerade.com/ocean-extra-vulnerability-cve-2026-86803/). ## WordPress security, without the noise One e-mail when something matters: new attacks seen in the wild, plugin updates and practical guides. No spam, unsubscribe in one click.