WP Vulnerability WatchVulnerability data as of September 7, 2026

Known vulnerabilities in Ocean Extra

The ultimate companion for OceanWP. Adds local Google Fonts, mega menus, site templates, and per-page settings for total design authority.

18Reported vulnerabilities
9.8Highest CVSS score
2.5.8Latest version
500,000+Active installs

What to do now

Update Ocean Extra to 2.5.4 or later. 18 of these have a fixed version available. Updating resolves them.

Plugin last updated: July 28, 2026 / Tested up to WordPress: 7.0.4 / View on wordpress.org

Reported vulnerabilities

Ordered by how urgently they need attention — whether a vulnerability is actually being exploited, and how likely exploitation is, rather than CVSS severity alone.

CVESeverityExploit probability
next 30 days		 Affected versionsFixed inPublished
CVE-2019-16250 High 7.5 1.4% 1.5.8 and earlier 1.5.9 September 11, 2019
CVE-2022-3374 High 7.2 1.2% Before 2.0.5 2.0.5 October 31, 2022
CVE-2023-0749 Medium 6.5 0.7% Before 2.1.3 2.1.3 March 13, 2023
CVE-2025-3472 Critical 9.8 1.9% Before 2.4.7 2.4.7 April 22, 2025
CVE-2021-25104 Medium 6.1 1.4% Before 1.9.5 1.9.5 June 20, 2022
CVE-2020-36760 Medium 4.3 0.6% 1.6.5 and earlier 1.6.6 July 12, 2023
CVE-2024-37489 Medium 6.4 0.3% 2.2.9 and earlier 2.3.0 July 4, 2024
CVE-2024-5531 Medium 6.4 0.3% 0 to 2.2.8 (inclusive) 2.2.9 June 11, 2024
CVE-2024-3167 Medium 6.4 0.5% Before 2.2.7 2.2.7 April 9, 2024
CVE-2023-24399 Medium 6.4 0.3% 2.1.2 and earlier 2.1.3 February 14, 2023
CVE-2023-23891 Medium 6.4 0.3% 2.1.1 and earlier 2.1.2 February 1, 2023
CVE-2025-9499 Medium 6.4 0.2% 0 to 2.4.9 (inclusive) 2.5.0 August 30, 2025
CVE-2025-3458 Medium 5.4 0.3% Before 2.4.7 2.4.7 April 22, 2025
CVE-2025-3457 Medium 5.4 0.3% Before 2.4.7 2.4.7 April 22, 2025
CVE-2024-1277 Medium 5.4 0.5% Before 2.2.5 2.2.5 February 29, 2024
CVE-2025-49068 Medium 5.4 0.2% 2.4.8 and earlier 2.4.9 June 2, 2025
CVE-2026-34903 Medium 4.3 0.3% 2.5.3 and earlier 2.5.4 April 7, 2026
CVE-2023-49164 Medium 4.3 0.3% 2.2.2 and earlier 2.2.3 November 28, 2023

Sources: vulnerability records from NVD, exploitation from CISA KEV, exploit probability from EPSS. Affected versions come from CPE ranges or from the reporting CNA.