CVE-2025-13307
High
Description
The Ocean Modal Window WordPress plugin before 2.3.3 is vulnerable to Remote Code Execution via the modal display logic. These modals can be displayed under user-controlled conditions that Editors and Administrators can set (edit_pages capability). The conditions are then executed as part of an eval statement executed on every site page. This leads to remote code execution.
SeverityHigh
CVSS7.2
Exploit probability—
ProductOcean Modal Window
PublishedDec 19, 2025
First seenDec 19, 2025
Weakness typeCWE-94Code injection
How to fix
Update
- Ocean Modal Window2.3.3 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Ocean Modal Window | v < 2.3.3 | 2.3.3 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.