The Ocean Extra plugin contains a Stored XSS flaw in its oceanwp_icon shortcode. The flaw arises because attributes supplied to the shortcode are not properly sanitized or escaped, enabling an authenticated user with contributor‑level access or higher to inject JavaScript that is stored in the post content. When a victim views the page containing the injected content, the malicious script runs in that visitor’s browser, potentially stealing credentials, hijacking sessions, or defacing the site.

All installations of the Ocean Extra WordPress plugin version 2.4.6 or earlier are affected. The plugin is distributed under the Ocean Extra product from OceanWP. The vulnerability can be present in any WordPress site that has the plugin installed and the oceanwp_icon shortcode enabled.

The CVSS score of 6.4 indicates moderate severity. The EPSS value is reported at less than 1%, suggesting a low probability of exploitation. The plugin is not listed in the CISA KEV catalog. Because the flaw requires authenticated contributor‑level access, an attacker must first obtain or abuse such credentials, which is a prerequisite before the stored XSS payload can be injected. Once the malicious script is stored, it executes in the browsers of all visitors who view the modified page, granting the attacker client‑side control and potential credential theft.