Ocean Pro Demos CVE-2026-81929

Exploitation requires the target WordPress site to run an affected premium OceanWP plugin (Ocean Pro Demos <=1.5.4 or Ocean eComm Treasure Box <=1.8.0) with a valid premium license active, the Popup Builder module enabled, and at least one published Gutenberg popup configured to display on a page. Given those configuration prerequisites, the attack itself needs no authentication and no attacker-side user interaction - the flaw is insufficient authorization on the save_popup_content AJAX action. Limiting factors: the premium-license, specific-module, and published-popup requirements are non-default conditions that significantly narrow which installations are actually exploitable; the stored payload only fires for visitors of pages where the affected popup is set to display.

The CVSS 3.1 base score of 7.2 (High) is driven by a network attack vector (AV:N), low complexity (AC:L), no required privileges (PR:N, i.e. unauthenticated per the 'insufficient authorization' flaw in the save_popup_content AJAX action), no user interaction on the attacker's side (UI:N), and a changed scope (S:C) reflecting that injected script executes in visitors' browsers beyond the vulnerable WordPress component, with Low confidentiality and integrity impact and no availability impact (C:L/I:L/A:N). No EPSS score, SSVC decision, KEV listing, or public POC was provided in the input, so there is no signal of active or probable exploitation to corroborate the High base score - this currently reads as a high-CVSS issue whose real-world priority is tempered by the absence of exploitation evidence AND by substantial non-attacker deployment prerequisites (a valid premium license, the enabled Popup Builder module, and at least one published Gutenberg popup configured for display). These prerequisites are site-configuration conditions, not attacker barriers, but they meaningfully shrink the exploitable population. Net: a legitimately exploitable unauthenticated stored XSS worth patching promptly on affected premium OceanWP installs, but not a drop-everything internet-wide emergency absent exploitation telemetry. EPSS, KEV, SSVC, and POC data are all MISSING and should be checked before final triage.

An unauthenticated attacker sends a crafted request to the Popup Builder's save_popup_content AJAX action, injecting malicious JavaScript into the 'content' parameter of a published Gutenberg popup. Because authorization, sanitization, and output escaping are insufficient, the script is stored and later executes in the browser of every visitor who loads a page where that popup is configured to display. No public exploit code was identified in the provided data, but the attack requires no authentication and no attacker-side user interaction.