The Ocean Extra plugin for WordPress suffers from a stored XSS vulnerability due to improper neutralization of input in the 'oceanwp_icon' shortcode. This allows authenticated users with contributor or higher privileges to inject arbitrary JavaScript into pages, which executes in the context of users viewing those pages. The issue stems from inadequate input sanitization and output escaping of user-supplied shortcode attributes. The vulnerability affects all versions up to and including 2.4.6 and has a CVSS 3.1 base score of 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N).

An attacker with contributor-level access or higher can exploit this vulnerability to execute arbitrary scripts in the browsers of users who visit the compromised pages. This can lead to limited confidentiality and integrity impacts, such as session hijacking or content manipulation. There is no impact on availability. The vulnerability requires authentication and low attack complexity but affects the entire security scope (scope changed).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access carefully and consider disabling or limiting use of the 'oceanwp_icon' shortcode. Monitor for updates from the OceanWP vendor regarding patches or official mitigations.