CVE-2026-81929

{
  "etk_id": "ETK-2026-1057",
  "cve_id": "CVE-2026-81929",
  "display_id": "CVE-2026-81929",
  "ghsa_id": "GHSA-g78h-gc63-cm8r",
  "euvd_id": "EUVD-2026-95509",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Stored cross-site scripting in Ocean Pro Demos and Ocean eComm Treasure Box",
  "summary": "Ocean Pro Demos through 1.5.4 and Ocean eComm Treasure Box through 1.8.0 are affected by stored cross-site scripting in the Popup Builder. An unauthenticated attacker may cause script execution for visitors viewing pages where an affected published Gutenberg popup is displayed. Exploitation requires a valid premium license, the Popup Builder module, and a configured published popup.",
  "mitigation": "Disable the Popup Builder module and unpublish or remove configured Gutenberg popups until an updated release is available. Restrict access to affected WordPress installations and review existing popup content for unauthorized changes.",
  "vendor": "OceanWP",
  "product": "Ocean Pro Demos",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, <= 1.5.4"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "Ocean Pro Demos",
      "purl": null
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, <= 1.8.0"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "Ocean eComm Treasure Box",
      "purl": null
    }
  ],
  "cwes": [
    79
  ],
  "cvss_score": 7.2,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
  "epss_score": 0.0024,
  "epss_percentile": 0.1433,
  "epss_asof": "2026-10-20",
  "automation": "deterministic",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 19.657098966666666,
  "t0_at": "2026-10-09T06:42:14.242000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-09T06:42:14.242000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-09T06:42:14.242000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-81929"
    }
  }
}