The vulnerability, tracked as CVE-2026-81929, affects Ocean Pro Demos versions up to and including 1.5.4, and Ocean eComm Treasure Box versions up to and including 1.8.0. Successful exploitation occurs when a victim accesses a page where a malicious popup is configured to display, leading to script execution within the user's browser session. Prerequisites for this attack include a valid premium license, the activation of the Popup Builder module, and at least one published Gutenberg popup. This flaw poses a significant risk as it allows for unauthorized script execution in the context of user sessions, potentially leading to session hijacking or administrative credential theft.

Impact

Successful exploitation allows unauthenticated attackers to perform Stored XSS against users visiting the site. This can result in session hijacking, unauthorized actions performed on behalf of legitimate users, or the redirection of site traffic to malicious domains. The vulnerability impacts any WordPress installation utilizing the vulnerable versions of these plugins with the specified module and popup configuration enabled.

Recommendation

Prioritized actions for security teams managing WordPress environments:

• Identify and audit all WordPress installations utilizing 'Ocean Pro Demos' and 'Ocean eComm Treasure Box'.
• Verify the plugin versions in use against the vulnerable ranges: Ocean Pro Demos <= 1.5.4 and Ocean eComm Treasure Box <= 1.8.0.
• Upgrade both plugins to versions released after 1.5.4 and 1.8.0 respectively, as soon as security patches are available from the vendor.
• Disable the 'Popup Builder' module if it is not required for site functionality to eliminate the attack surface for this CVE.