Is Ocean Extra safe?

Plugin details

• Slug: ocean-extra
• Requires PHP: 7.4+
• Max supported PHP (analyzed): 8.4

Known vulnerabilities

• Ocean Extra [ocean-extra] < 1.5.9 [CVE-2019-16250, Ocean Extra &lt;= 1.5.8 - Unauthenticated Settings change and CSS injection, Ocean Extra <= 1.5.7 - Unauthenticated Options update and CSS injection]
• Ocean Extra [ocean-extra] < 1.9.4 [WordPress Ocean Extra plugin < 1.9.4 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability]
• Ocean Extra [ocean-extra] < 1.9.4 [WordPress Ocean Extra plugin < 1.9.4 - Sensitive Information Disclosure vulnerability]
• Ocean Extra [ocean-extra] < 1.6.6 [WordPress Ocean Extra plugin <= 1.6.5 - Cross-Site Request Forgery (CSRF) vulnerability]
• Ocean Extra [ocean-extra] < 1.5.9 [WordPress Ocean Extra plugin <= 1.5.8 - Unauthenticated Settings change vulnerability]

+ 28 more known vulnerabilities

• Ocean Extra [ocean-extra] < 1.5.9 [WordPress Ocean Extra plugin <= 1.5.8 - Unauthenticated CSS injection vulnerability]
• Ocean Extra [ocean-extra] < 1.9.5 [CVE-2021-25104, WordPress Ocean Extra plugin <= 1.9.4 - Reflected Cross-Site Scripting (XSS) vulnerability, Ocean Extra &lt; 1.9.5 - Reflected Cross-Site Scripting, Ocean Extra <= 1.9.4 - Reflected Cross-Site Scripting, EUVD-2021-12016]
• Ocean Extra [ocean-extra] < 1.9.4 [Unauthorised AJAX Calls via Freemius]
• Ocean Extra [ocean-extra] < 2.0.5 [CVE-2022-3374, WordPress Ocean Extra plugin <= 2.0.4 - Auth. PHP Objection Injection vulnerability, Ocean Extra <= 2.0.4 - Authenticated (Administrator+) PHP Object Injection, Ocean Extra &lt; 2.0.5 - Admin+ PHP Objection Injection]
• Ocean Extra [ocean-extra] < 1.9.4 [Freemius SDK <= 2.4.2 - Missing Authorization Checks]
• Ocean Extra [ocean-extra] < 1.6.6 [Various Affected Software (Various Versions) - Cross-Site Request Forgery Bypass]
• Ocean Extra [ocean-extra] < 2.1.2 [Ocean Extra <= 2.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode]
• Ocean Extra [ocean-extra] < 2.1.3 [CVE-2023-23891, WordPress Ocean Extra Plugin <= 2.1.1 is vulnerable to Cross Site Scripting (XSS), Ocean Extra &lt; 2.1.2 - Contributor+ Stored XSS]
• Ocean Extra [ocean-extra] < 2.1.3 [Ocean Extra <= 2.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting]
• Ocean Extra [ocean-extra] < 2.1.3 [CVE-2023-0749, Ocean Extra <= 2.1.2 - Authenticated (Subscriber+) Arbitrary Post Access, WordPress Ocean Extra Plugin < 2.1.3 is vulnerable to Sensitive Data Exposure, Ocean Extra &lt; 2.1.3 - Subscriber+ Arbitrary Post Content Disclosure]
• Ocean Extra [ocean-extra] < 2.1.3 [CVE-2023-24399, WordPress Ocean Extra Plugin <= 2.1.2 is vulnerable to Cross Site Scripting (XSS)]
• Ocean Extra [ocean-extra] < 1.6.6 [CVE-2021-4342]
• Ocean Extra [ocean-extra] < 1.6.6 [CVE-2020-36760, Ocean Extra <=1.6.5 - Cross-Site Request Forgery Bypass]
• Ocean Extra [ocean-extra] < 2.1.8 [CVE-2023-33999, WordPress Ocean Extra Plugin <= 2.1.7 is vulnerable to Cross Site Scripting (XSS), Freemius SDK &lt; 2.5.10 - Reflected Cross-Site Scripting]
• Ocean Extra [ocean-extra] < 2.1.3 [Ocean Extra &lt; 2.1.3 - Contributor+ Stored XSS]
• Ocean Extra [ocean-extra] < 2.2.3 [Ocean Extra <= 2.2.2 - Cross-Site Request Forgery to Arbitrary Plugin Activation]
• Ocean Extra [ocean-extra] < 2.2.3 [CVE-2023-49164, WordPress Ocean Extra Plugin <= 2.2.2 is vulnerable to Cross Site Request Forgery (CSRF), Ocean Extra &lt; 2.2.3 - Cross-Site Request Forgery to Arbitrary Plugin Activation]
• Ocean Extra [ocean-extra] < 2.2.5 [CVE-2024-1277, Ocean Extra <= 2.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting, WordPress Ocean Extra Plugin <= 2.2.4 is vulnerable to Cross Site Scripting (XSS), Ocean Extra &lt; 2.2.5 - Contributor+ Stored XSS]
• Ocean Extra [ocean-extra] < 2.2.7 [CVE-2024-3167, Ocean Extra <= 2.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting, WordPress Ocean Extra Plugin <= 2.2.6 is vulnerable to Cross Site Scripting (XSS)]
• Ocean Extra [ocean-extra] < 2.2.9 [CVE-2024-5531, Ocean Extra <= 2.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Flickr Widget, WordPress Ocean Extra Plugin <= 2.2.8 is vulnerable to Cross Site Scripting (XSS)]
• Ocean Extra [ocean-extra] < 2.3.0 [CVE-2024-37489, WordPress Ocean Extra Plugin <= 2.2.9 is vulnerable to Cross Site Scripting (XSS), Ocean Extra <= 2.2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting]
• Ocean Extra [ocean-extra] < 2.4.7 [CVE-2025-3472, WordPress Ocean Extra Plugin <= 2.4.6 is vulnerable to Content Injection, Ocean Extra <= 2.4.6 - Unauthenticated Arbitrary Shortcode Execution, EUVD-2025-12293]
• Ocean Extra [ocean-extra] < 2.4.7 [CVE-2025-3458, Ocean Extra <= 2.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'ocean_gallery_id', EUVD-2025-12295]
• Ocean Extra [ocean-extra] < 2.4.7 [CVE-2025-3457, Ocean Extra <= 2.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode, EUVD-2025-12292]
• Ocean Extra [ocean-extra] < 2.4.9 [CVE-2025-49068, Ocean Extra <= 2.4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting, EUVD-2025-17135]
• Ocean Extra [ocean-extra] < 2.5.0 [CVE-2025-9499, Ocean Extra <= 2.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via oceanwp_library Shortcode, EUVD-2025-28862]
• Ocean Extra [ocean-extra] < 2.5.4 [CVE-2026-34903, Ocean Extra <= 2.5.3 - Missing Authorization]
• Ocean Extra [ocean-extra] < 2.4.4 [CVE-2024-13362, Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter]

Vulnerabilities are matched against the exact installed version when it's known. Always keep the plugin updated to the latest release.

Safer / more established alternatives

• Meta Box — 500000+ active installs — max PHP 8.4
• Pure Metafields — 10000+ active installs — max PHP 8.4
• Multi Image Metabox — 6000+ active installs
• CubeWP Framework — 4000+ active installs
• MB Elementor Integration — 2000+ active installs