CVE-2026-115592: WordPress OceanWP theme <= 4.2.7 - Cross Site Scripting (XSS) vulnerability
Published Oct 29, 2026
·Updated
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in OceanWP OceanWP oceanwp allows Reflected XSS.This issue affects OceanWP: from n/a through 4.2.7.
Affected Software
1 affected component
Oceanwp OceanWP<=4.2.7
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress OceanWP themeto a version that resolves this vulnerability.Fixed in 4.2.8
Event History
Oct 29, 2026
CVE Published
via MITRE·11:00 AM
Data Sourced
via MITRE·11:00 AM
RemedyDescriptionSeverityWeakness
Frequently Asked Questions
1
Which installations are affected?
OceanWP installations running versions through 4.2.7 are affected. The available data does not identify a fixed version.
2
What does an attacker need to exploit this issue?
The attacker does not need prior privileges and can attack over the network, but exploitation requires user interaction. Successful exploitation can have low-impact effects on confidentiality, integrity, and availability, with scope changed.