CVE-2026-81929— Ocean Pro Demos <= 1.5.4 and Ocean eComm Treasure Box <= 1.8.0 - Unauthenticated Stored Cross-Site Scripting via 'content' Parameter
Quick assessment
Affected
OceanWP Ocean Pro Demos
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
WordPress 的 Ocean Pro Demos 和 Ocean eComm Treasure Box 插件分别存在存储型跨站脚本（XSS）漏洞。该漏洞出现在所有版本小于等于 1.5.4 的 Ocean Pro Demos 插件，以及所有版本小于等于 1.8.0 的 Ocean eComm Treasure Box 插件中。漏洞成因在于 Popup Builder 模块的 save_popup_content AJAX 操作中，存在授权验证不足、输入过滤不充分以及输出未正确转义等问题。 由于上述缺陷，未经身份
Possible ATT&CK Techniques 2 AI
T1189 · Drive-by Compromise T1059 · Command and Scripting Interpreter
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-81929
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Ocean Pro Demos <= 1.5.4 and Ocean eComm Treasure Box <= 1.8.0 - Unauthenticated Stored Cross-Site Scripting via 'content' Parameter
Source: CVE Program / CVE List V5
Vulnerability Description
The Ocean Pro Demos and Ocean eComm Treasure Box plugins for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content' parameter in all versions up to, and including, 1.5.4, and 1.8.0, respectively, due to insufficient authorization, input sanitization, and output escaping in the Popup Builder's save_popup_content AJAX action. This makes it possible for unauthenticated attackers to inject arbitrary web scripts into a published Gutenberg popup that will execute whenever a user accesses a page on which the popup is configured to display. A valid premium license, the Popup Builder module, and at least one published Gutenberg popup configured for display are required.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| OceanWP | Ocean Pro Demos | 0 ~ 1.5.4 | - |
|
| OceanWP | Ocean eComm Treasure Box | 0 ~ 1.8.0 | - |
|
II. Public POCs for CVE-2026-81929
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-81929
请登录查看更多情报信息。
Other References for CVE-2026-81929 (4)
IV. Related Vulnerabilities
Same vendor: OceanWP
-
CVE-2026-56007
WordPress Ocean Product Sharing plugin <= 2.2.2 - Cross Site -
CVE-2026-34903
WordPress Ocean Extra plugin <= 2.5.3 - Broken Access Contro -
CVE-2025-9499
Ocean Extra <= 2.4.9 - Authenticated (Contributor+) Stored C -
CVE-2025-8891
OceanWP <= 4.0.9 - 4.1.1 - Cross-Site Request Forgery to Oce -
CVE-2025-7500
Ocean Social Sharing <= 2.2.1 - Authenticated (Contributor+)
Same weakness: CWE-79
-
CVE-2026-62049
WordPress JetBlocks For Elementor plugin <= 1.5.2.1 - Cross -
CVE-2026-4264
Reflected Cross-Site Scripting in BeeTienda eCommerce platfo -
CVE-2026-106155
Stored Cross-site Scripting (XSS) in Telerik Report Server W -
CVE-2026-107889
Keycloak-services: keycloak-services: stored xss on login pa -
CVE-2026-107801
Jivejdon through 5.0 Stored XSS via Attachment Upload Conten
V. Comments for CVE-2026-81929
No comments yet