OceanWP Ocean Pro Demos / eComm Treasure Box: Stored XSS in Popup Builder

Summary

Two OceanWP WordPress plugins, Ocean Pro Demos (up to 1.5.4) and Ocean eComm Treasure Box (up to 1.8.0), contain a stored Cross-Site Scripting flaw in the Popup Builder's save_popup_content AJAX action. An unauthenticated attacker can inject JavaScript into a published Gutenberg popup, which then runs in the browsers of visitors to pages where the popup is displayed. Exploitation requires a valid premium license, the Popup Builder module enabled, and at least one published Gutenberg popup configured for display.

Affected

• Ocean Pro Demos: 0 to 1.5.4
• Ocean eComm Treasure Box: 0 to 1.8.0

Fixed in

• Ocean Pro Demos: Unknown. The vendor changelog lists "Potential vulnerability patched" under 1.5.5 (Sep 08 2026), citing a Wordfence report. Vendor confirmation is pending.
• Ocean eComm Treasure Box: Unknown. The vendor changelog lists "Potential vulnerability patched" under 1.8.1 (Sep 08 2026). Vendor confirmation is pending.

Workaround

• No vendor workaround published.
• Disable the Popup Builder module if it is not required.
• Review existing published Gutenberg popups for unexpected script content.

Exploitation

• CISA SSVC: Exploitation none, Automatable yes.
• Not listed in CISA KEV; no evidence of exploitation in the wild found.
• No public proof-of-concept found.
• VulDB rates exploitation as easy; this is a database assessment, not an observed attack.

Our recommendation

• Check whether the Popup Builder is in use and whether any published Gutenberg popups exist.
• Review popup content for injected scripts and check recent edits by low-privilege accounts.
• Update both plugins to the first fixed version once the vendor confirms it; until then, treat versions up to the affected ranges as vulnerable.
• Limit editor and contributor accounts and enable automatic plugin updates where acceptable.
• Consider WAF virtual patching and verify that the rule actually blocks the request path.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Ocean Pro Demos Changelog docs.oceanwp.org
• Ocean eComm Treasure Box Changelog docs.oceanwp.org
• OceanWP Popup Builder documentation docs.oceanwp.org
• Wordfence threat intelligence advisory www.wordfence.com
• CVE record mirror (threatint) cve.threatint.com
• VulDB entry vuldb.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 3 Nov 2026, 05:57.