Ocean Extra vulnerabilities

The Ocean Extra plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to and including 2.6.0. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.

The Ocean Extra plugin for WordPress (through version 2.5.3) contains a Missing Authorization vulnerability that allows exploitation of incorrectly configured access control security levels.

The Ocean Extra plugin for WordPress is vulnerable to stored XSS via the 'oceanwp_library' shortcode in versions up to and including 2.4.9 due to insufficient sanitization and escaping of user-supplied attributes. An authenticated attacker with Contributor-level access or higher can inject arbitrary scripts that execute when a user visits the page.