The Ocean Extra plugin for WordPress suffers from a stored cross-site scripting vulnerability due to improper neutralization of input in the 'ocean_gallery_id' parameter. This allows authenticated users with Contributor or higher privileges to inject malicious scripts that persist in pages and execute upon access by other users. The Classic Editor plugin must be active for exploitation. The vulnerability affects all versions up to and including 2.4.6. No official patch or fix information is provided in the available data.

Successful exploitation allows an authenticated user with Contributor-level access or above to inject persistent malicious scripts into pages, potentially leading to session hijacking, defacement, or other script-based attacks against users who view the injected content. The impact is limited to confidentiality and integrity with no direct availability impact. The requirement for authenticated access and the Classic Editor plugin reduces the attack surface.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor-level access to trusted users only and consider disabling the Classic Editor plugin if not required, as its activation is necessary for exploitation. Monitor vendor channels for updates and apply patches promptly once released.