CVE-2025-5524: OceanWP <= 4.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Select HTML Tag
The OceanWP theme for WordPress is vulnerable to Stored Cross-Site Scripting via the Select HTML tag in all versions up to, and including, 4.0.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-5524?
CVE-2025-5524 has a moderate severity level due to its ability to allow stored cross-site scripting.
How does CVE-2025-5524 affect WordPress users?
CVE-2025-5524 affects users of the OceanWP theme for WordPress, allowing authenticated attackers to exploit stored XSS vulnerabilities.
How do I fix CVE-2025-5524?
To fix CVE-2025-5524, upgrade the OceanWP theme to version 4.1.0 or later where the vulnerability has been addressed.
Which versions of OceanWP are affected by CVE-2025-5524?
CVE-2025-5524 affects all versions of OceanWP theme up to and including version 4.0.9.
Who can exploit CVE-2025-5524?
Only authenticated users with Contributor-level access can exploit the vulnerability described in CVE-2025-5524.