The Ocean Modal Window WordPress plugin before 2.3.3 is vulnerable to Remote Code Execution via the modal display logic. These modals can be displayed under user-controlled conditions that Editors and Administrators can set (edit_pages capability). The conditions are then executed as part of an eval statement executed on every site page. This leads to remote code execution.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Ocean Modal Window Plugin | — | Update ocean-modal-window plugin to version 2.3.3, or a newer patched version | Dec 22, 2025 | Nov 28, 2025 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub