Ocean Pro Demos
Monthly
Stored cross-site scripting in the OceanWP "Ocean Pro Demos" (up to and including 1.5.4) and "Ocean eComm Treasure Box" (up to and including 1.8.0) WordPress plugins allows unauthenticated remote attackers to inject arbitrary JavaScript into a published Gutenberg popup through the Popup Builder's save_popup_content AJAX action, which then executes in the browser of any visitor viewing a page where that popup is configured to display. The CVSS 3.1 base score is 7.2 (High) with vector AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, reflecting a network-reachable, low-complexity attack requiring no privileges or user interaction, though the scope-changed rating and low confidentiality/integrity impact reflect that payload execution is confined to the victim's browser context. Exploitation is conditional: the site must run an affected premium plugin with a valid premium license active, the Popup Builder module enabled, and at least one published Gutenberg popup configured for display; there is no public exploit identified at time of analysis and the vulnerability is not confirmed actively exploited (no CISA KEV listing), with no EPSS score provided in the source data.
Stored cross-site scripting in the OceanWP "Ocean Pro Demos" (up to and including 1.5.4) and "Ocean eComm Treasure Box" (up to and including 1.8.0) WordPress plugins allows unauthenticated remote attackers to inject arbitrary JavaScript into a published Gutenberg popup through the Popup Builder's save_popup_content AJAX action, which then executes in the browser of any visitor viewing a page where that popup is configured to display. The CVSS 3.1 base score is 7.2 (High) with vector AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, reflecting a network-reachable, low-complexity attack requiring no privileges or user interaction, though the scope-changed rating and low confidentiality/integrity impact reflect that payload execution is confined to the victim's browser context. Exploitation is conditional: the site must run an affected premium plugin with a valid premium license active, the Popup Builder module enabled, and at least one published Gutenberg popup configured for display; there is no public exploit identified at time of analysis and the vulnerability is not confirmed actively exploited (no CISA KEV listing), with no EPSS score provided in the source data.