Ocean Extra

How well this listing is tuned to rank in WordPress.org search, on the factors an owner controls. Not popularity, optimization.

Directory rank vs rivals

wp.org popularity rank over time · higher is better · when a rival's line climbs above yours, they've overtaken you

How often this plugin actually ships. A steady rhythm is the maintenance signal a single "last updated" date can't show.

Share of active installs on each version of this plugin · 63% run the current release. Green is the current release; a big slice on older versions is a user base that has stopped updating.

Refined from the date this plugin crossed into its current band.

No paid tier is visible, so we don't put a figure on revenue or sale value: that would be guessing. The install base is a real asset to an acquirer, just not one public data lets us price.

1. ★★★★★ msantiagoov

   2.2y ago

   Is a great Plugin

   Read on wp.org ↗
2. ★★★★★ Atul Prajapati

   3.3y ago

   Greetings from India,I am doing website development work for the last 7 years. I have given many of my customers websites with OceanWP theme! All my customers are completely satisfied with the performance of OceanWP! I thank the developer of Ocean very much!

   Read on wp.org ↗
3. ★★★★★ matejem

   3.5y ago

   Recommend not to use. This is a lot of issue causing theme. Issue with jQuery caused bad written theme code. Do not trust this. Poor support which do not resolve issue, they say it is your mistake and they do not care. Waste of time you do not want.. Theme is really slow and not flexible. Issue with apple devices. Scammers.

   Read on wp.org ↗
4. ★★★★★ andrea666

   3.7y ago

   in the middle year I had a problem and now. I try everyting… I install worpress again and step that I fing in the web and after days…I find the solution and now the same problem… I did the same and It doesn´t work. I desintale the plugin. ¡TERRIBLE!

   Read on wp.org ↗
5. ★★★★★ merten

   4.0y ago

   Error ab version 2.0.4 🙁

   Read on wp.org ↗
6. ★★★★★ Robbyw

   4.0y ago

   A few days ago all 30 of my sites that use the ocean extra plugin went down. They all said: “There has been a critical error on this website” – had a terrible time explaining to my clients what went wrong… Is there any sign of this plugin being more secure in the future? or should I just scrap it, I love the ocean wp theme and this gives it some extra functionality that I need but this last issue was a huge red flag… not sure what to do now as I am worried about the next big crash…

   Read on wp.org ↗
7. ★★★★★ wyllspace

   4.0y ago

   Crushed my site, so many problems around it. It was even hard to log in and fix everything like never happend to me with any other plugin. That I would be even denied logging in 🙁

   Read on wp.org ↗
8. ★★★★★ picturebox1

   4.0y ago

   The update broke my website and was unusable. My hosts recovered the website but they were unable to get Ocean Extra to work after several attempts. It crashed both front and back end. We are closing this website in the next 2 weeks but sadly it is now a mess for our visitors in the meantime. Please check/test your updates more thoroughly before publishing. I suspect it was the shortcode that caused the issue but not sure. This topic was modified 3 years, 11 months ago by picturebox1.

   Read on wp.org ↗

Recent releases and news for this plugin

1. — Version 2.5.7 Added: Customizer: Icon for the new OceanWP ‘Accessibility – A11Y’ panel. Requires latest OceanWP 4.2.0 version. Improved: Widgets: Flickr: Script handling when widget not in use. 2.5.7
2. — Version 2.5.6 Updated: Compatibility: WordPress version number. 2.5.6
3. — Version 2.5.5 Updated: Setup Wizard: Optional newsletter integration provider changed in favor of a self-hosted solution. Remains strictly opt-in. Fixed: Hooks: Hook condition on product category pages. Also relates to the exact same 2.5.5
4. — Version 2.5.4 Fixed: Potential vulnerability patched: Report by Patchstack from FEB 16th 2026 / patch verification from MAR 4th 2026. Shoutout and a thanks to the Patchstack team for patch test and confirmation. 2.5.4
5. — Version 2.5.3 Improved: Demo Import: Dynamic menu location assignment after import. Improved: Demo Import: Conditional step validation of the import workflow. 2.5.3
6. — Version 2.5.2 All previous changelogs available at: https://docs.oceanwp.org/article/654-ocean-extra-changelog 2.5.2

21 disclosed vulnerabilities on record for this plugin, all fixed in the current version. Sites on older versions stay exposed until they update.

1. Medium · 6.1 Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter ↗
   2026-04-30 CVE-2024-13362 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 2.4.2 Patched in 2.4.4
2. Medium · 4.3 Ocean Extra <= 2.5.3 - Missing Authorization ↗
   2026-04-07 CVE-2026-34903 Missing Authorization Affects <= 2.5.3 Patched in 2.5.4
3. Medium · 6.4 Ocean Extra <= 2.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via oceanwp_library Shortcode ↗
   2025-08-29 CVE-2025-9499 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 2.4.9 Patched in 2.5.0
4. Medium · 5.4 Ocean Extra <= 2.4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting ↗
   2025-06-02 CVE-2025-49068 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 2.4.8 Patched in 2.4.9
5. Medium · 6.4 Ocean Extra <= 2.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ↗
   2025-04-21 CVE-2025-3457 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 2.4.6 Patched in 2.4.7
6. Medium · 6.5 Ocean Extra <= 2.4.6 - Unauthenticated Arbitrary Shortcode Execution ↗
   2025-04-21 CVE-2025-3472 Improper Control of Generation of Code ('Code Injection') Affects <= 2.4.6 Patched in 2.4.7
7. Medium · 6.4 Ocean Extra <= 2.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'ocean_gallery_id' ↗
   2025-04-21 CVE-2025-3458 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 2.4.6 Patched in 2.4.7
8. Medium · 6.4 Ocean Extra <= 2.2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting ↗
   2024-07-04 CVE-2024-37489 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 2.2.9 Patched in 2.3.0
9. Medium · 6.4 Ocean Extra <= 2.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Flickr Widget ↗
   2024-06-10 CVE-2024-5531 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 2.2.8 Patched in 2.2.9
10. Medium · 6.4 Ocean Extra <= 2.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting ↗
    2024-04-08 CVE-2024-3167 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 2.2.6 Patched in 2.2.7
11. Medium · 6.4 Ocean Extra <= 2.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting ↗
    2024-02-16 CVE-2024-1277 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 2.2.4 Patched in 2.2.5
12. Medium · 4.3 Ocean Extra <= 2.2.2 - Cross-Site Request Forgery to Arbitrary Plugin Activation ↗
    2023-11-28 CVE-2023-49164 Cross-Site Request Forgery (CSRF) Affects <= 2.2.2 Patched in 2.2.3
13. Medium · 6.1 Freemius SDK <= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get ↗
    2023-07-18 CVE-2023-33999 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects 1.5.12 - 2.1.6 Patched in 2.1.8
14. Medium · 6.5 Ocean Extra <= 2.1.2 - Authenticated (Subscriber+) Arbitrary Post Access ↗
    2023-02-14 CVE-2023-0749 Authorization Bypass Through User-Controlled Key Affects <= 2.1.2 Patched in 2.1.3
15. Medium · 6.4 Ocean Extra <= 2.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting ↗
    2023-02-14 CVE-2023-24399 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 2.1.2 Patched in 2.1.3
16. Medium · 6.4 Ocean Extra <= 2.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ↗
    2023-02-01 CVE-2023-23891 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 2.1.1 Patched in 2.1.2
17. High · 7.2 Ocean Extra <= 2.0.4 - Authenticated (Administrator+) PHP Object Injection ↗
    2022-10-10 CVE-2022-3374 Deserialization of Untrusted Data Affects <= 2.0.4 Patched in 2.0.5
18. Medium · 6.1 Ocean Extra <= 1.9.4 - Reflected Cross-Site Scripting ↗
    2022-05-24 CVE-2021-25104 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects < 1.9.5 Patched in 1.9.5
19. Medium · 6.3 Freemius SDK <= 2.4.2 - Missing Authorization Checks ↗
    2022-03-04 CVE-2022-4974 Missing Authorization Affects < 1.9.4 Patched in 1.9.4
20. Medium · 4.3 Ocean Extra <=1.6.5 - Cross-Site Request Forgery Bypass ↗
    2020-09-26 CVE-2020-36760 Cross-Site Request Forgery (CSRF) Affects < 1.6.6 Patched in 1.6.6
21. High · 7.5 Ocean Extra <= 1.5.7 - Unauthenticated Options update and CSS injection ↗
    2019-07-03 CVE-2019-16250 Improper Authentication Affects <= 1.5.8 Patched in 1.5.9

Automated install-time checks, tested on PHP 8.1.12 · WP 7.0

Translated into 23 languages, 9 at 90% or more

Growth timeline

Install-tier crossings we have observed, and how long each tier took to outgrow

1. 2025-09-13 600K+ → 500K+ down after 478 days in tier
2. 2024-05-23 700K+ → 600K+ down

Competes with

The plugins that solve the same job, ranked by shared tags then reach, closest match first. The letter on the right is each plugin's health grade (A best, F worst).

• Attesa Extra 1K+ installs · 3.6★ · 3 shared tags B
• One Click Demo Import 1M+ installs · 4.3★ · 1 shared tag A
• Meta Box 500K+ installs · 4.8★ · 1 shared tag A
• SiteOrigin Widgets Bundle 400K+ installs · 4.8★ · 1 shared tag A
• Blocksy Companion 300K+ installs · 4.6★ · 1 shared tag A
• Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress 300K+ installs · 3.8★ · 1 shared tag B

Embed this report card

Drop a live Pulse card for Ocean Extra into a readme, a review or a deck. It updates itself.

Ocean Extra: 500K+ active installs, 3.3★ (67 reviews). Plugin Pulse (WP Mayor), as of 2026-08-25. https://plugins.wpmayor.com/plugin/ocean-extra