CVE-2025-9499

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-9499", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-08-26T18:29:32.475Z", "datePublished": "2025-08-30T04:25:05.117Z", "dateUpdated": "2026-04-08T16:43:15.780Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:43:15.780Z"}, "affected": [{"vendor": "oceanwp", "product": "Ocean Extra", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "2.4.9", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Ocean Extra plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's oceanwp_library shortcode in all versions up to, and including, 2.4.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "Ocean Extra <= 2.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via oceanwp_library Shortcode", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/290e9d95-0dac-4cc8-8cef-9e7974405f36?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/ocean-extra/tags/2.4.9/includes/panel/library-shortcode.php#L57"}, {"url": "https://wordpress.org/plugins/ocean-extra/"}, {"url": "https://plugins.trac.wordpress.org/changeset/3351880"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Muhammad Yudha - DJ"}], "timeline": [{"time": "2025-08-26T18:45:35.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-08-29T16:24:26.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-09-02T15:13:58.448532Z", "id": "CVE-2025-9499", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-02T15:14:08.406Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-9499", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-09-02T15:13:58.448532Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-02T15:14:03.960Z"}}], "cna": {"title": "Ocean Extra <= 2.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via oceanwp_library Shortcode", "credits": [{"lang": "en", "type": "finder", "value": "Muhammad Yudha - DJ"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "oceanwp", "product": "Ocean Extra", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "2.4.9"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-08-26T18:45:35.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-08-29T16:24:26.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/290e9d95-0dac-4cc8-8cef-9e7974405f36?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/ocean-extra/tags/2.4.9/includes/panel/library-shortcode.php#L57"}, {"url": "https://wordpress.org/plugins/ocean-extra/"}, {"url": "https://plugins.trac.wordpress.org/changeset/3351880"}], "descriptions": [{"lang": "en", "value": "The Ocean Extra plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's oceanwp_library shortcode in all versions up to, and including, 2.4.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:43:15.780Z"}}}, "cveMetadata": {"cveId": "CVE-2025-9499", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:43:15.780Z", "dateReserved": "2025-08-26T18:29:32.475Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-08-30T04:25:05.117Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Ocean Extra", "vendor": "oceanwp", "versions": [{"lessThanOrEqual": "2.4.9", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Ocean Extra plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's oceanwp_library shortcode in all versions up to, and including, 2.4.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}, {"lang": "es", "value": "El plugin Ocean Extra para WordPress es vulnerable a Cross-Site Scripting Almacenado a trav\u00e9s del shortcode oceanwp_library del plugin en todas las versiones hasta la 2.4.9, inclusive, debido a una sanitizaci\u00f3n de entrada y un escape de salida insuficientes en los atributos proporcionados por el usuario. Esto hace posible que atacantes autenticados, con acceso de nivel de colaborador y superior, inyecten scripts web arbitrarios en p\u00e1ginas que se ejecutar\u00e1n cada vez que un usuario acceda a una p\u00e1gina inyectada."}], "id": "CVE-2025-9499", "lastModified": "2026-10-18T21:10:00.120", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-9499", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-09-02T15:13:58.448532Z", "version": "2.0.3"}}]}, "published": "2025-08-30T05:15:48.230", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/ocean-extra/tags/2.4.9/includes/panel/library-shortcode.php#L57"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3351880"}, {"source": "security@wordfence.com", "url": "https://wordpress.org/plugins/ocean-extra/"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/290e9d95-0dac-4cc8-8cef-9e7974405f36?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T14:23:54.560790+00:00", "value": {"mitigation_remediation": ["Update Ocean Extra to version 2.5.0 or later to remove the vulnerable shortcode handling.", "Disable or remove the oceanwp_library shortcode entirely from all pages or posts where it is not needed.", "Restrict contributor roles or implement stricter role management so that only trusted users can publish or edit content that may contain the shortcode."], "summary": {"action": "Apply Patch", "impact": "Stored Cross\u2011Site Scripting with contributor\u2011level authentication required"}, "threat_synthesis": {"affected_systems": "WordPress sites that have the Ocean Extra plugin installed in any version up to and including 2.4.9 are affected. Site administrators, developers, and owners using this plugin must verify their installed version and upgrade if necessary.", "description_and_impact": "The Ocean Extra plugin allows an authenticated user with contributor or higher permissions to embed arbitrary scripts in a site page via the oceanwp_library shortcode. Unsanitized user supplied attributes enable a stored cross\u2011site scripting flaw, identified as CWE\u201179. When the malicious page is loaded by any visitor the injected scripts execute, compromising confidentiality, integrity, and potentially availability of the site content.", "risk_and_exploitability": "The CVSS score is 6.4, indicating moderate severity, while the EPSS score is less than 1\u202f%, suggesting a very low probability of exploitation in the wild. The vulnerability is not listed in CISA\u2019s KEV catalog. Exploitation requires only contributor\u2011level authentication and does not rely on privileged or administrative access, which makes it feasible for well\u2011positioned attackers. However, the low exploit probability and lack of public exploitation evidence imply that the risk is moderate but still noteworthy."}}}}, "created": "2025-08-31T08:41:32.494030+00:00", "updated": "2026-04-22T14:30:18.960022+00:00", "vendors": ["oceanwp", "oceanwp$PRODUCT$ocean_extra", "wordpress", "wordpress$PRODUCT$wordpress"]}