Live › vulnerability › CVE-2026-115592
OceanWP, a WordPress theme, has a reflected cross-site scripting flaw: input is not neutralized before it is written into a page. An attacker who tricks a user into opening a crafted link can run script in that user's browser session.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 11:24 UTC. All times on this page are UTC.
Websites running the OceanWP WordPress theme at version 4.2.7 or earlier. The flaw is reflected, so exposure depends on the page handling user input; the sources do not name the affected code path or the required setup.
No product ranges from the sources yet.
4.2.7 are affected; move to a later release than 4.2.7 (the sources do not name the fixed version).Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in OceanWP OceanWP oceanwp allows Reflected XSS.This issue affects OceanWP: from n/a through 4.2.7.
This page as .md · .json · in your agent: get_signal("CVE-2026-115592")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.