¿Es seguro Ocean Extra?

Qué hace este plugin

• Slug: ocean-extra
• 500000+ instalaciones activas

meta boxmetaboxmetaboxesoceanwpwidgets

Estado de mantenimiento

• Última versión conocida: 2.5.7
• Requiere PHP: 7.4+
• PHP máximo soportado (analizado): 8.4

Vulnerabilidades conocidas

21 CVEs conocidos registrados para Ocean Extra.

CVE-2024-13362

Multiple plugins and/or themes for WordPress are vulnerable to Reflected Cross-Site Scripting via the url parameter in various versions due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2026-34903

The Ocean Extra plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 2.5.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform an unauthorized action.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2025-49068

The Ocean Extra plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.4.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2024-37489

The Ocean Extra plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.2.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2024-5531

The Ocean Extra plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Flickr widget in all versions up to, and including, 2.2.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2024-3167

Update the WordPress Ocean Extra plugin to the latest available version (at least 2.2.7). wesley (wcraft) discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Ocean Extra Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has been fixed in version 2.2.7. Have additional information or questions about this entry? Get in touch.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

CVE-2024-1277

Update the WordPress Ocean Extra plugin to the latest available version (at least 2.2.5). Webbernaut discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Ocean Extra Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has been fixed in version 2.2.5. Have additional information or questions about this entry? Get in touch.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

CVE-2023-49164

The Ocean Extra plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2.2. This is due to missing or incorrect nonce validation on the ajax_required_plugins_activate() function. This makes it possible for unauthenticated attackers to activate arbitrary plugins via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: WPScan

+ 25 vulnerabilidades conocidas más

CVE	Vulnerabilidad	Tipo	Gravedad	Afectadas	Corregido en	Publicado	Estado
—	Ocean Extra [ocean-extra] < 2.2.3	—	Desconocido	< 2.2.3	2.2.3	2023-11-28	✓ corregido en la última versión
CVE-2023-33999	Ocean Extra [ocean-extra] < 2.1.8	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Alta 7,1	< 2.1.8	2.1.8	2023-07-18	✓ corregido en la última versión
CVE-2021-4342	Ocean Extra [ocean-extra] < 1.6.6	—	Desconocido	< 1.6.6	1.6.6	2023-06-07	✓ corregido en la última versión
CVE-2023-24399	Ocean Extra [ocean-extra] < 2.1.3	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Media 5,5	< 2.1.3	2.1.3	2023-02-15	✓ corregido en la última versión
—	Ocean Extra [ocean-extra] < 2.1.3	—	Desconocido	< 2.1.3	2.1.3	2023-02-14	✓ corregido en la última versión
CVE-2023-0749	Ocean Extra [ocean-extra] < 2.1.3	Elusión de autorización mediante una clave controlada por el usuario	Media 6,5	< 2.1.3	2.1.3	2023-02-14	✓ corregido en la última versión
CVE-2023-23891	Ocean Extra [ocean-extra] < 2.1.3	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Media 5,5	< 2.1.3	2.1.3	2023-02-02	✓ corregido en la última versión
—	Ocean Extra [ocean-extra] < 2.1.2	—	Desconocido	< 2.1.2	2.1.2	2023-02-01	✓ corregido en la última versión
CVE-2022-3374	Ocean Extra [ocean-extra] < 2.0.5	Deserialización de datos no confiables	Alta 7,2	< 2.0.5	2.0.5	2022-10-10	✓ corregido en la última versión
CVE-2021-25104	Ocean Extra [ocean-extra] < 1.9.5	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Media 6,1	< 1.9.5	1.9.5	2022-05-24	✓ corregido en la última versión
—	Ocean Extra [ocean-extra] < 1.9.4	Falta de control de autorización	Media 6,3	< 1.9.4	1.9.4	2022-03-04	✓ corregido en la última versión
—	Ocean Extra [ocean-extra] < 1.9.4	—	Desconocido	< 1.9.4	1.9.4	2022-02-28	✓ corregido en la última versión
—	Ocean Extra [ocean-extra] < 1.9.4	—	Desconocido	< 1.9.4	1.9.4	2022-02-28	✓ corregido en la última versión
CVE-2020-36760	Ocean Extra [ocean-extra] < 1.6.6	Falsificación de petición en sitios cruzados (CSRF)	Media 4,3	< 1.6.6	1.6.6	2020-09-26	✓ corregido en la última versión
—	Ocean Extra [ocean-extra] < 1.6.6	—	Desconocido	< 1.6.6	1.6.6	2020-09-16	✓ corregido en la última versión
—	Ocean Extra [ocean-extra] < 1.5.9	—	Desconocido	< 1.5.9	1.5.9	2019-07-04	✓ corregido en la última versión
—	Ocean Extra [ocean-extra] < 1.5.9	—	Desconocido	< 1.5.9	1.5.9	2019-07-04	✓ corregido en la última versión
CVE-2019-16250	Ocean Extra [ocean-extra] < 1.5.9	Autenticación indebida	Alta 7,5	< 1.5.9	1.5.9	2019-07-03	✓ corregido en la última versión
CVE-2025-3472	Ocean Extra [ocean-extra] < 2.4.7	Control incorrecto de la generación de código (inyección de código)	Crítica 9,8	< 2.4.7	2.4.7	0000-00-00	✓ corregido en la última versión
CVE-2025-3458	Ocean Extra [ocean-extra] < 2.4.7	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Media 5,4	< 2.4.7	2.4.7	0000-00-00	✓ corregido en la última versión
CVE-2025-3457	Ocean Extra [ocean-extra] < 2.4.7	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Media 5,4	< 2.4.7	2.4.7	0000-00-00	✓ corregido en la última versión
CVE-2025-9499	Ocean Extra [ocean-extra] < 2.5.0	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Media 6,4	< 2.5.0	2.5.0	0000-00-00	✓ corregido en la última versión
—	Ocean Extra [ocean-extra] < 1.9.4	—	Desconocido	< 1.9.4	1.9.4	—	✓ corregido en la última versión
—	Ocean Extra [ocean-extra] < 1.6.6	—	Desconocido	< 1.6.6	1.6.6	—	✓ corregido en la última versión
—	Ocean Extra [ocean-extra] < 2.1.3	—	Desconocido	< 2.1.3	2.1.3	—	✓ corregido en la última versión

Ocean Extra [ocean-extra] < 2.2.3

The Ocean Extra plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2.2. This is due to missing or incorrect nonce validation on the ajax_required_plugins_activate() function. This makes it possible for unauthenticated attackers to activate arbitrary plugins via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2023-33999

Update the WordPress Ocean Extra plugin to the latest available version (at least 2.1.8). Rafie Muhammad (Patchstack) discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Ocean Extra Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has been fixed in version 2.1.8.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

CVE-2021-4342

CVE split into individual CVE IDs for each software record.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2023-24399

Update the WordPress Ocean Extra plugin to the latest available version (at least 2.1.3). Rafie Muhammad (Patchstack) discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Ocean Extra Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has been fixed in version 2.1.3.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

Ocean Extra [ocean-extra] < 2.1.3

The Ocean Extra plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in versions up to, and including, 2.1.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2023-0749

The Ocean Extra for WordPress is vulnerable to disclosure of potentially sensitive data in versions up to, and including, 2.1.2. This is due to to the [oceanwp_library] shortcode not properly validating a post's status prior to returning the post's content. This makes it possible for authenticated attackers with subscriber-level permissions and above to retrieve arbitrary post content, even when it is in a pre-published or private status.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2023-23891

Update the WordPress Ocean Extra plugin to the latest available version (at least 2.1.2). Rafshanzani Suhada discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Ocean Extra Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has been fixed in version 2.1.2.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

Ocean Extra [ocean-extra] < 2.1.2

The Ocean Extra plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in versions up to, and including, 2.1.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2022-3374

The Ocean Extra plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 2.0.4 via deserialization of untrusted input when processing a malicious customizer styling file. This allows administrator-level attackers to inject a PHP Object. No POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2021-25104

Reflected Cross-Site Scripting (XSS) vulnerability discovered by JrXnm in WordPress Ocean Extra plugin (versions <= 1.9.4). Update the WordPress Ocean Extra plugin to the latest available version (at least 1.9.5).

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

Ocean Extra [ocean-extra] < 1.9.4

The Freemius SDK, as used by hundreds of WordPress plugin and theme developers, was vulnerable to Cross-Site Request Forgery and Information disclosure due to missing capability checks and nonce protection on the _get_debug_log, _get_db_option, and the _set_db_option functions in versions up to, and including 2.4.2. Any WordPress plugin or theme running a version of Freemius less than 2.4.3 is vulnerable.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

Ocean Extra [ocean-extra] < 1.9.4

Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability discovered in WordPress Ocean Extra plugin (versions < 1.9.4).

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

Ocean Extra [ocean-extra] < 1.9.4

Sensitive Information Disclosure vulnerability discovered in WordPress Ocean Extra plugin (versions < 1.9.4).

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

CVE-2020-36760

The Ocean Extra plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.6.5]. This is due to missing or incorrect nonce validation on the add_core_extensions_bundle_validation() function. This makes it possible for unauthenticated attackers to validate extension bundles via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

Ocean Extra [ocean-extra] < 1.6.6

Cross-Site Request Forgery (CSRF) vulnerability found by Jerome Bruandet (NinTechNet) in WordPress Ocean Extra plugin (versions <= 1.6.5).

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

Ocean Extra [ocean-extra] < 1.5.9

Unauthenticated Settings change vulnerability found by Jerome Bruandet in WordPress Ocean Extra plugin (versions <= 1.5.8).

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

Ocean Extra [ocean-extra] < 1.5.9

Unauthenticated CSS injection vulnerability found by Jerome Bruandet in WordPress Ocean Extra plugin (versions <= 1.5.8).

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

CVE-2019-16250

includes/wizard/wizard.php in the Ocean Extra plugin through 1.5.8 for WordPress allows unauthenticated options changes and injection of a Cascading Style Sheets (CSS) token sequence.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2025-3472

The Ocean Extra plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.4.6. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes when WooCommerce is also installed and activated.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2025-3458

The Ocean Extra plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ocean_gallery_id’ parameter in all versions up to, and including, 2.4.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The Classic Editor plugin must be installed and activated to exploit the vulnerability.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2025-3457

The Ocean Extra plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'oceanwp_icon' shortcode in all versions up to, and including, 2.4.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2025-9499

The Ocean Extra plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's oceanwp_library shortcode in all versions up to, and including, 2.4.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

Ocean Extra [ocean-extra] < 1.9.4

The plugins and themes use an insecure version of the Freemius Framework, which is lacking CSRF and/or authorisation in some of its AJAX actions. As a result, any authenticated users, such as subscriber could access the debug logs. Unauthenticated attackers could also make a logged in admin toggle the debug mode via a CSRF attack.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: WPScan

Ocean Extra [ocean-extra] < 1.6.6

Over 70 plugins and themes were vulnerable to Cross-Site Request Forgery due to improperly implemented nonce protection that could be bypassed.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

Ocean Extra [ocean-extra] < 2.1.3

The plugin does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: WPScan

Cómo solucionarlo

Mantén Ocean Extra actualizado — 2.5.7 es la última versión en wordpress.org, y cada CVE de arriba indica la versión exacta que lo corrigió ("Corregido en").

Este es el historial completo de vulnerabilidades conocidas del plugin, no un escaneo de una instalación específica — ejecuta un escaneo gratis de tu propio sitio para verificar tu versión instalada exacta.

Alternativas más seguras / más establecidas

• Meta Box — 500000+ instalaciones activas — 96/100 (164) — PHP máx. 8.4
• Pure Metafields — 10000+ instalaciones activas — 86/100 (6) — PHP máx. 8.4
• Multi Image Metabox — 6000+ instalaciones activas — 98/100 (11)
• CubeWP Framework — 4000+ instalaciones activas — 96/100 (12) — PHP máx. 8.4
• MB Elementor Integration — 2000+ instalaciones activas — 74/100 (3)