The Ocean Extra plugin for WordPress is vulnerable to Stored Cross‑Site Scripting (CWE‑79) via the ocean_gallery_id parameter in all versions up to and including 2.4.6. Authenticated users with Contributor level or higher can inject arbitrary JavaScript that will run when a page containing the injected gallery is viewed. Because the scripts are stored in the database, all site visitors who load the injected gallery will execute the malicious code, potentially allowing data theft, session hijacking or defacement. The vulnerability requires the Classic Editor plugin to be installed and activated to function.

WordPress sites running the Ocean Extra plugin version 2.4.6 or earlier are affected. The issue exists in all builds of the plugin up to that version, and the Classic Editor plugin must also be present. Updates beyond 2.4.6 remove the flaw, so the vulnerability does not apply to later releases.

The CVSS base score of 6.4 indicates a medium severity vulnerability, while the EPSS score of less than 1% suggests a low likelihood of real‑world exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. An attacker needs Contributor or higher rights and enabled Classic Editor plugin, so the risk is confined to sites with permissive contributor roles. If those conditions are met, the attacker could inject malicious scripts that run for any site visitor, leading to cross‑site data theft or defacement.