Skip to content
PluginCanary

Ocean Extra

by oceanwp · 400,000+ active installs · Checked 3 Nov 2026
Healthy1 Warning

Healthy: vulnerability published 14 Oct 2026, fixed in 2.6.1.

81/ 100 Canary Score
Sub-scores for Ocean Extra
Ownership100
Maintenance100
Security60
Support70
Reputation70

How the score works

Active signals

Facts we detected, with links to the source.

  • WarningSEC-1Vulnerability published 14 Oct 2026, fixed in 2.6.1. Update to version 2.6.1 or later.14 Oct 2026Evidence
  • InfoSEC-38 vulnerabilities published in the last 24 months. Review this plugin.4 Nov 2026Evidence

Ownership timeline

Who commits to the plugin's code on wordpress.org, over time.

Committers and their active periods
oceanwp23 Oct 2016 to 11 Aug 2020, 140 commits
svovaf26 Aug 2019 to 11 Sep 2019, 9 commits
apprimit30 Sep 2020 to 13 Oct 2026, 123 commits

3 committers recorded. No ownership changes recorded since 3 Nov 2026.

Maintenance

Last release
22 days ago
Releases, 24 months
21
Tested up to
7.1 current
Requires PHP
7.4 supported 8.2+
Releases per quarter for Ocean Extra
Q1 20242
Q2 20243
Q3 20241
Q4 20245
Q1 20252
Q2 20254
Q3 20252
Q4 20251
Q1 20263
Q2 20262
Q3 20265
Q4 20261

Last release 13 Oct 2026. Tested with WordPress 7.1 (current).

Support

0% of 1 support threads resolved in the last 2 months.

Security record

PublishedIssueCVSSAffectedFixed inDays to patch
14 Oct 2026Ocean Extra <= 2.6.0 - Unauthenticated Arbitrary Shortcode Execution via 'oceanwp_library' Shortcode Template6.5<= 2.6.02.6.10
30 Apr 2026Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter6.1<= 2.4.22.4.40
7 Apr 2026Ocean Extra <= 2.5.3 - Missing Authorization4.3<= 2.5.32.5.40
29 Aug 2025Ocean Extra <= 2.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via oceanwp_library Shortcode6.4<= 2.4.92.5.00
2 Jun 2025Ocean Extra <= 2.4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting5.4<= 2.4.82.4.90
21 Apr 2025Ocean Extra <= 2.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4<= 2.4.62.4.70
21 Apr 2025Ocean Extra <= 2.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'ocean_gallery_id'6.4<= 2.4.62.4.70
21 Apr 2025Ocean Extra <= 2.4.6 - Unauthenticated Arbitrary Shortcode Execution6.5<= 2.4.62.4.70
4 Jul 2024Ocean Extra <= 2.2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4<= 2.2.92.3.00
10 Jun 2024Ocean Extra <= 2.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Flickr Widget6.4<= 2.2.82.2.90
8 Apr 2024Ocean Extra <= 2.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4<= 2.2.62.2.70
16 Feb 2024Ocean Extra <= 2.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4<= 2.2.42.2.50
28 Nov 2023Ocean Extra <= 2.2.2 - Cross-Site Request Forgery to Arbitrary Plugin Activation4.3<= 2.2.22.2.30
18 Jul 2023Freemius SDK <= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get6.11.5.12 to 2.1.62.1.81
14 Feb 2023Ocean Extra <= 2.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4<= 2.1.22.1.30
14 Feb 2023Ocean Extra <= 2.1.2 - Authenticated (Subscriber+) Arbitrary Post Access6.5<= 2.1.22.1.30
1 Feb 2023Ocean Extra <= 2.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4<= 2.1.12.1.20
10 Oct 2022Ocean Extra <= 2.0.4 - Authenticated (Administrator+) PHP Object Injection7.2<= 2.0.42.0.5n/a
24 May 2022Ocean Extra <= 1.9.4 - Reflected Cross-Site Scripting6.1< 1.9.51.9.5n/a
4 Mar 2022Freemius SDK <= 2.4.2 - Missing Authorization Checks6.3< 1.9.41.9.4n/a
26 Sep 2020Ocean Extra <=1.6.5 - Cross-Site Request Forgery Bypass4.3< 1.6.61.6.6n/a
3 Jul 2019Ocean Extra <= 1.5.7 - Unauthenticated Options update and CSS injection7.5<= 1.5.81.5.9n/a

Source: Wordfence Intelligence.

Reputation

Average rating 5.0 in Q2 2024.

Rating distribution
5 star37
4 star0
3 star1
2 star6
1 star23
Latest low reviews

Momentum

400,000+ active installs. History builds with each weekly snapshot.

Weekly downloads, last 27 weeks
Weekly downloads for Ocean Extra
4 May 20267,307
11 May 202616,345
18 May 2026195,472
25 May 202627,282
1 Jun 202619,041
8 Jun 202615,726
15 Jun 202614,039
22 Jun 202612,416
29 Jun 2026171,416
6 Jul 202643,637
13 Jul 202618,862
20 Jul 202617,192
27 Jul 2026172,007
3 Aug 202644,401
10 Aug 202617,824
17 Aug 2026190,970
24 Aug 202624,957
31 Aug 202620,428
7 Sep 2026307,979
14 Sep 202644,472
21 Sep 2026198,773
28 Sep 202622,723
5 Oct 202618,775
12 Oct 2026161,748
19 Oct 202631,946
26 Oct 202639,425
2 Nov 20262,710

Weekly downloads over the last 4 weeks are 14% below the 27-week average.

Healthier alternatives

Same category, higher Canary Score. Never sponsored.

Starter Sites & Templates by NeveScore 91 · 100,000+Import / Export Customizer SettingsScore 91 · 50,000+Sydney ToolboxScore 91 · 50,000+Bosa Starter SitesScore 91 · 30,000+Clever FoxScore 91 · 30,000+

Facts

Version2.6.3
Authoroceanwp
Added23 Oct 2016
Last updated13 Oct 2026
Active installs400,000+
Requires WordPress5.9
Tested up to7.1.4
Requires PHP7.4
CategoryDesign & Themes > Themes & Templates
Tagsmetabox, oceanwp, widgets, meta box, metaboxes

Other plugins by this author: Ocean Social Sharing, Ocean Product Sharing, Ocean Stick Anything, Ocean Custom Sidebar, Ocean Posts Slider, Ocean Modal Window

Questions

Is Ocean Extra still maintained?

Ocean Extra was last updated on 13 Oct 2026. Its Canary status is Healthy.

Is Ocean Extra safe?

Ocean Extra has no open unpatched vulnerabilities on record. 8 vulnerabilities were published in the last 24 months. Its Canary status is Healthy.

Who owns Ocean Extra?

The wordpress.org author is oceanwp. Recent committers: apprimit, oceanwp, svovaf, plugin-master. We have recorded no ownership change.

What can I use instead of Ocean Extra?

Plugins in the same category with a higher Canary Score: Starter Sites & Templates by Neve, Import / Export Customizer Settings, Sydney Toolbox, Bosa Starter Sites, Clever Fox.

Data: wordpress.org Plugins API, plugins SVN and Trac, wordpress.org reviews, Wordfence Intelligence.Plugin data refreshed 3 Nov 2026.Report a data issue