CVE-2019-16250: Oceanwp Ocean Extra

High severity, CVSS 7.5. EPSS: 1.4% chance of exploitation in the next 30 days.

includes/wizard/wizard.php in the Ocean Extra plugin through 1.5.8 for WordPress allows unauthenticated options changes and injection of a Cascading Style Sheets (CSS) token sequence.

Affected products

• Oceanwp Ocean Extra: up to and including 1.5.8

Published 2019-09-11. Last modified 2026-06-17.