CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 0CVE-2023-23891 – WordPress Ocean Extra Plugin <= 2.1.1 is vulnerable to Cross Site Scripting (XSS)
https://notcve.org/view.php?id=CVE-2023-23891
01 Feb 2023 — Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in OceanWP Ocean Extra plugin <= 2.1.1 versions. Needs the OceanWP theme installed and activated. The Ocean Extra plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in versions up to, and including, 2.1.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor level and above permissions to inject... • https://patchstack.com/database/vulnerability/ocean-extra/wordpress-ocean-extra-plugin-2-1-1-cross-site-scripting-xss-vulnerability?_s_id=cve • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.3EPSS: 0%CPEs: 1EXPL: 1CVE-2022-3374 – Ocean Extra < 2.0.5 - Admin+ PHP Objection Injection
https://notcve.org/view.php?id=CVE-2022-3374
10 Oct 2022 — The Ocean Extra WordPress plugin before 2.0.5 unserialises the content of an imported file, which could lead to PHP object injections issues when a high privilege user import (intentionally or not) a malicious Customizer Styling file and a suitable gadget chain is present on the blog. El complemento Ocean Extra de WordPress anterior a 2.0.5 deserializa el contenido de un archivo importado, lo que podría provocar problemas de inyección de objetos PHP cuando un usuario con privilegios elevados importa (intenc... • https://wpscan.com/vulnerability/22fd3f28-9036-4bd5-ad98-ff78bd1b51bc • CWE-502: Deserialization of Untrusted Data •
CVSS: 6.1EPSS: 11%CPEs: 1EXPL: 1CVE-2021-25104 – Ocean Extra < 1.9.5 - Reflected Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2021-25104
24 May 2022 — The Ocean Extra WordPress plugin before 1.9.5 does not escape generated links which are then used when the OceanWP is active, leading to a Reflected Cross-Site Scripting issue El plugin Ocean Extra de WordPress versiones anteriores a 1.9.5, no escapa de los enlaces generados que luego son usados cuando el OceanWP está activo, conllevando a un problema de tipo Cross-Site Scripting Reflejado • https://wpscan.com/vulnerability/2ee6f1d8-3803-42f6-9193-3dd8f416b558 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.5EPSS: 0%CPEs: 425EXPL: 0CVE-2022-4974 – Freemius SDK <= 2.4.2 - Missing Authorization Checks
https://notcve.org/view.php?id=CVE-2022-4974
04 Mar 2022 — The Freemius SDK, as used by hundreds of WordPress plugin and theme developers, was vulnerable to Cross-Site Request Forgery and Information disclosure due to missing capability checks and nonce protection on the _get_debug_log, _get_db_option, and the _set_db_option functions in versions up to, and including 2.4.2. Any WordPress plugin or theme running a version of Freemius less than 2.4.3 is vulnerable. • https://www.wordfence.com/threat-intel/vulnerabilities/id/39fb0499-9ab4-4a2f-b0db-ece86bcf4d42?source=cve • CWE-862: Missing Authorization •
CVSS: 5.0EPSS: 0%CPEs: 1EXPL: 8CVE-2020-36760 – Ocean Extra <=1.6.5 - Cross-Site Request Forgery Bypass
https://notcve.org/view.php?id=CVE-2020-36760
26 Sep 2020 — The Ocean Extra plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.6.5]. This is due to missing or incorrect nonce validation on the add_core_extensions_bundle_validation() function. This makes it possible for unauthenticated attackers to validate extension bundles via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. • https://blog.nintechnet.com/25-wordpress-plugins-vulnerable-to-csrf-attacks • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 1CVE-2019-16250 – Ocean Extra <= 1.5.7 - Unauthenticated Options update and CSS injection
https://notcve.org/view.php?id=CVE-2019-16250
03 Jul 2019 — includes/wizard/wizard.php in the Ocean Extra plugin through 1.5.8 for WordPress allows unauthenticated options changes and injection of a Cascading Style Sheets (CSS) token sequence. El archivo incluye/wizard/wizard.php en el plugin Ocean Extra versiones hasta 1.5.8 para WordPress, permite cambios de opciones no autenticados e inyección de una secuencia de tokens de tipo Cascading Style Sheets (CSS). • https://blog.nintechnet.com/settings-change-and-css-injection-in-wordpress-ocean-extra-plugin • CWE-287: Improper Authentication •