CVE-2021-25104: Oceanwp Ocean Extra

Medium severity, CVSS 6.1. EPSS: 1.4% chance of exploitation in the next 30 days.

The Ocean Extra WordPress plugin before 1.9.5 does not escape generated links which are then used when the OceanWP is active, leading to a Reflected Cross-Site Scripting issue

Affected products

• Oceanwp Ocean Extra: before 1.9.5 (fixed in 1.9.5)

Published 2022-06-20. Last modified 2026-06-17.