Ocean Extra

How well this listing is tuned to rank in WordPress.org search, on the factors an owner controls. Not popularity, optimization.

Directory searches this plugin turns up in, and which way each one is moving. WordPress.org publishes no history of search positions, so this starts the day we first tracked a keyword and never backfills.

wp.org is where the directory puts the plugin for that search. On merit is where it would sit if results were ranked on rating, support and updates, without the install boost. The last column is how far the wp.org position moved, from our first reading in the last 90 days to the latest.

111 searches this plugin appeared in over the last 90 days, 20 listed. 76 left out as unrelated or noise (years, numbers, stray words). 1 of its tags isn't in the top 24 for their own search.

Directory rank vs rivals

wp.org popularity rank over time · higher is better · when a rival's line climbs above yours, they've overtaken you

How often this plugin actually ships. A steady rhythm is the maintenance signal a single "last updated" date can't show.

Share of active installs on each version of this plugin. Green is the current release; a big slice on older versions is a user base that has stopped updating.

Crossed into this band 9 days ago and the previous band took 13 months to cross, so the real count is still just under 500K.

1. ★★★★★ msantiagoov

   2.3y ago

   Is a great Plugin

   Read on wp.org ↗
2. ★★★★★ Atul Prajapati

   3.5y ago

   Greetings from India,I am doing website development work for the last 7 years. I have given many of my customers websites with OceanWP theme! All my customers are completely satisfied with the performance of OceanWP! I thank the developer of Ocean very much!

   Read on wp.org ↗
3. ★★★★★ matejem

   3.6y ago

   Recommend not to use. This is a lot of issue causing theme. Issue with jQuery caused bad written theme code. Do not trust this. Poor support which do not resolve issue, they say it is your mistake and they do not care. Waste of time you do not want.. Theme is really slow and not flexible. Issue with apple devices. Scammers.

   Read on wp.org ↗
4. ★★★★★ andrea666

   3.9y ago

   in the middle year I had a problem and now. I try everyting… I install worpress again and step that I fing in the web and after days…I find the solution and now the same problem… I did the same and It doesn´t work. I desintale the plugin. ¡TERRIBLE!

   Read on wp.org ↗
5. ★★★★★ merten

   4.2y ago

   Error ab version 2.0.4 🙁

   Read on wp.org ↗
6. ★★★★★ Robbyw

   4.2y ago

   A few days ago all 30 of my sites that use the ocean extra plugin went down. They all said: “There has been a critical error on this website” – had a terrible time explaining to my clients what went wrong… Is there any sign of this plugin being more secure in the future? or should I just scrap it, I love the ocean wp theme and this gives it some extra functionality that I need but this last issue was a huge red flag… not sure what to do now as I am worried about the next big crash…

   Read on wp.org ↗
7. ★★★★★ wyllspace

   4.2y ago

   Crushed my site, so many problems around it. It was even hard to log in and fix everything like never happend to me with any other plugin. That I would be even denied logging in 🙁

   Read on wp.org ↗
8. ★★★★★ picturebox1

   4.2y ago

   The update broke my website and was unusable. My hosts recovered the website but they were unable to get Ocean Extra to work after several attempts. It crashed both front and back end. We are closing this website in the next 2 weeks but sadly it is now a mess for our visitors in the meantime. Please check/test your updates more thoroughly before publishing. I suspect it was the shortcode that caused the issue but not sure. This topic was modified 3 years, 11 months ago by picturebox1.

   Read on wp.org ↗

Recent releases and news for this plugin

1. — Version 2.5.7 Added: Customizer: Icon for the new OceanWP ‘Accessibility – A11Y’ panel. Requires latest OceanWP 4.2.0 version. Improved: Widgets: Flickr: Script handling when widget not in use. 2.5.7
2. — Version 2.5.6 Updated: Compatibility: WordPress version number. 2.5.6
3. — Version 2.5.5 Updated: Setup Wizard: Optional newsletter integration provider changed in favor of a self-hosted solution. Remains strictly opt-in. Fixed: Hooks: Hook condition on product category pages. Also relates to the exact same 2.5.5
4. — Version 2.5.4 Fixed: Potential vulnerability patched: Report by Patchstack from FEB 16th 2026 / patch verification from MAR 4th 2026. Shoutout and a thanks to the Patchstack team for patch test and confirmation. 2.5.4
5. — Version 2.5.3 Improved: Demo Import: Dynamic menu location assignment after import. Improved: Demo Import: Conditional step validation of the import workflow. 2.5.3
6. — Version 2.5.2 All previous changelogs available at: https://docs.oceanwp.org/article/654-ocean-extra-changelog 2.5.2

All 23 disclosed vulnerabilities are patched in the current version (2.6.3). Sites still on an older version should update.

1. Patched Medium · 6.5 Ocean Extra <= 2.6.0 - Unauthenticated Arbitrary Shortcode Execution via 'oceanwp_library' Shortcode Template ↗
   2026-10-14 CVE-2026-86803 Improper Control of Generation of Code Affects <= 2.6.0 Patched in 2.6.1
2. Patched Medium · 6.4 Ocean Extra <= 2.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting ↗
   2026-09-23 CVE-2026-94684 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 2.6.1 Patched in 2.6.2
3. Patched Medium · 6.1 Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter ↗
   2026-04-30 CVE-2024-13362 Improper Neutralization of Input During Web Page Generation Affects <= 2.4.2 Patched in 2.4.4
4. Patched Medium · 4.3 Ocean Extra <= 2.5.3 - Missing Authorization ↗
   2026-04-07 CVE-2026-34903 Missing Authorization Affects <= 2.5.3 Patched in 2.5.4
5. Patched Medium · 6.4 Ocean Extra <= 2.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via oceanwp_library Shortcode ↗
   2025-08-29 CVE-2025-9499 Improper Neutralization of Input During Web Page Generation Affects <= 2.4.9 Patched in 2.5.0
6. Patched Medium · 5.4 Ocean Extra <= 2.4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting ↗
   2025-06-02 CVE-2025-49068 Improper Neutralization of Input During Web Page Generation Affects <= 2.4.8 Patched in 2.4.9
7. Patched Medium · 6.4 Ocean Extra <= 2.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ↗
   2025-04-21 CVE-2025-3457 Improper Neutralization of Input During Web Page Generation Affects <= 2.4.6 Patched in 2.4.7
8. Patched Medium · 6.5 Ocean Extra <= 2.4.6 - Unauthenticated Arbitrary Shortcode Execution ↗
   2025-04-21 CVE-2025-3472 Improper Control of Generation of Code Affects <= 2.4.6 Patched in 2.4.7
9. Patched Medium · 6.4 Ocean Extra <= 2.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'ocean_gallery_id' ↗
   2025-04-21 CVE-2025-3458 Improper Neutralization of Input During Web Page Generation Affects <= 2.4.6 Patched in 2.4.7
10. Patched Medium · 6.4 Ocean Extra <= 2.2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting ↗
    2024-07-04 CVE-2024-37489 Improper Neutralization of Input During Web Page Generation Affects <= 2.2.9 Patched in 2.3.0
11. Patched Medium · 6.4 Ocean Extra <= 2.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Flickr Widget ↗
    2024-06-10 CVE-2024-5531 Improper Neutralization of Input During Web Page Generation Affects <= 2.2.8 Patched in 2.2.9
12. Patched Medium · 6.4 Ocean Extra <= 2.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting ↗
    2024-04-08 CVE-2024-3167 Improper Neutralization of Input During Web Page Generation Affects <= 2.2.6 Patched in 2.2.7
13. Patched Medium · 6.4 Ocean Extra <= 2.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting ↗
    2024-02-16 CVE-2024-1277 Improper Neutralization of Input During Web Page Generation Affects <= 2.2.4 Patched in 2.2.5
14. Patched Medium · 4.3 Ocean Extra <= 2.2.2 - Cross-Site Request Forgery to Arbitrary Plugin Activation ↗
    2023-11-28 CVE-2023-49164 Cross-Site Request Forgery Affects <= 2.2.2 Patched in 2.2.3
15. Patched Medium · 6.1 Freemius SDK <= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get ↗
    2023-07-18 CVE-2023-33999 Improper Neutralization of Input During Web Page Generation Affects 1.5.12 - 2.1.6 Patched in 2.1.8
16. Patched Medium · 6.5 Ocean Extra <= 2.1.2 - Authenticated (Subscriber+) Arbitrary Post Access ↗
    2023-02-14 CVE-2023-0749 Authorization Bypass Through User-Controlled Key Affects <= 2.1.2 Patched in 2.1.3
17. Patched Medium · 6.4 Ocean Extra <= 2.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting ↗
    2023-02-14 CVE-2023-24399 Improper Neutralization of Input During Web Page Generation Affects <= 2.1.2 Patched in 2.1.3
18. Patched Medium · 6.4 Ocean Extra <= 2.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ↗
    2023-02-01 CVE-2023-23891 Improper Neutralization of Input During Web Page Generation Affects <= 2.1.1 Patched in 2.1.2
19. Patched High · 7.2 Ocean Extra <= 2.0.4 - Authenticated (Administrator+) PHP Object Injection ↗
    2022-10-10 CVE-2022-3374 Deserialization of Untrusted Data Affects <= 2.0.4 Patched in 2.0.5
20. Patched Medium · 6.1 Ocean Extra <= 1.9.4 - Reflected Cross-Site Scripting ↗
    2022-05-24 CVE-2021-25104 Improper Neutralization of Input During Web Page Generation Affects < 1.9.5 Patched in 1.9.5
21. Patched Medium · 6.3 Freemius SDK <= 2.4.2 - Missing Authorization Checks ↗
    2022-03-04 CVE-2022-4974 Missing Authorization Affects < 1.9.4 Patched in 1.9.4
22. Patched Medium · 4.3 Ocean Extra <=1.6.5 - Cross-Site Request Forgery Bypass ↗
    2020-09-26 CVE-2020-36760 Cross-Site Request Forgery Affects < 1.6.6 Patched in 1.6.6
23. Patched High · 7.5 Ocean Extra <= 1.5.7 - Unauthenticated Options update and CSS injection ↗
    2019-07-03 CVE-2019-16250 Improper Authentication Affects <= 1.5.8 Patched in 1.5.9

Automated install-time checks, tested on PHP 8.1.12 · WP 7.0

Translated into 25 languages, 11 at 90% or more

Plus 1 more locale with partial translations.

Whether ChatGPT and Claude name this plugin when asked the category question, and whether the readme gives them something to quote.

Not measured yet for this plugin’s topics. Its tracked searches are not among the measured topics. See the topics measured so far.

Growth timeline

Install-tier crossings we have observed, and how long each tier took to outgrow

1. 2026-10-22 500K+ → 400K+ down after 404 days in tier
2. 2025-09-13 600K+ → 500K+ down after 478 days in tier
3. 2024-05-23 700K+ → 600K+ down after 692 days in tier
4. 2022-07-01 800K+ → 700K+ down after 122 days in tier
5. 2022-03-01 700K+ → 800K+ up after 485 days in tier
6. 2020-11-01 600K+ → 700K+ up after 184 days in tier
7. 2020-05-01 500K+ → 600K+ up after 170 days in tier
8. 2019-11-13 400K+ → 500K+ up after 129 days in tier

Competes with

The plugins that solve the same job, ranked by shared tags then reach, closest match first. The letter on the right is each plugin's health grade (A best, F worst).

Embed this report card

Drop a live Pulse card for Ocean Extra into a readme, a review or a deck. It updates itself.

Ocean Extra: 400K+ active installs, 3.3★ (67 reviews). Plugin Pulse (WP Mayor), as of 2026-10-31. https://plugins.wpmayor.com/plugin/ocean-extra