CVE-2026-86803
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
The Ocean Extra plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to and including 2.6.0. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
Risk Assessment
An unauthenticated attacker can execute arbitrary shortcodes, potentially leading to information disclosure, content modification, or further exploitation of other vulnerabilities.
Recommendation
Update the Ocean Extra plugin to a version later than 2.6.0.
Other vulnerabilities in Ocean Extra
See all- CVE-2026-34903Medium
The Ocean Extra plugin for WordPress (through version 2.5.3) contains a Missing Authorization vulnerability that allows exploitation of incorrectly configured access control security levels.
- CVE-2025-9499Medium
The Ocean Extra plugin for WordPress is vulnerable to stored XSS via the 'oceanwp_library' shortcode in versions up to and including 2.4.9 due to insufficient sanitization and escaping of user-supplied attributes. An authenticated attacker with Contributor-level access or higher can inject arbitrary scripts that execute when a user visits the page.
Original NVD description (English source)
The The Ocean Extra plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.6.0 This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS