OceanWP, a WordPress theme, permits authenticated contributors or higher roles to insert arbitrary JavaScript through the Select HTML tag. The insufficient input sanitization allows a stored XSS payload to be persisted in page content, which executes in every user’s browser when the page is viewed. This can lead to defacement, credential theft or further session hijacking on victim sites, compromising the confidentiality and integrity of site users.

All installations of OceanWP theme with version 4.0.9 or earlier are affected. The problem exists in the theme’s JavaScript handling of the Select HTML tag within the content editor. Users running any OceanWP build up to and including 4.0.9 are at risk unless they have verified that the code has been patched.

The CVSS score of 4.9 reflects a moderate impact when an authorized contributor injects malicious script. The EPSS score of less than 1% indicates a low likelihood of exploitation at present, and the vulnerability is not listed in the CISA KEV catalog. Exploitability requires valid Contributor‑level credentials and the ability to edit or create content. Attackers could leverage the vulnerability to target visitors across the site, but broad, remote exploitation is limited to accounts with sufficient role permissions.