The Ocean Extra plugin allows an authenticated user with contributor or higher permissions to embed arbitrary scripts in a site page via the oceanwp_library shortcode. Unsanitized user supplied attributes enable a stored cross‑site scripting flaw, identified as CWE‑79. When the malicious page is loaded by any visitor the injected scripts execute, compromising confidentiality, integrity, and potentially availability of the site content.

WordPress sites that have the Ocean Extra plugin installed in any version up to and including 2.4.9 are affected. Site administrators, developers, and owners using this plugin must verify their installed version and upgrade if necessary.

The CVSS score is 6.4, indicating moderate severity, while the EPSS score is less than 1 %, suggesting a very low probability of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires only contributor‑level authentication and does not rely on privileged or administrative access, which makes it feasible for well‑positioned attackers. However, the low exploit probability and lack of public exploitation evidence imply that the risk is moderate but still noteworthy.