Ocean Extra

by oceanwp

View on WordPress.org

83 Quality Score

Active Installs

26/30

With 500,000 active installs, the plugin has a substantial user base that signals real-world adoption.

Update Freshness

25/25

The plugin was last updated in late June 2026 and lists compatibility with WordPress 7.0, indicating active development.

User Rating

10/15

A 66 out of 100 rating from 67 reviews suggests users find it useful but not exceptional.

Support Health

8/15

Only 2 support threads exist with a 0.0% resolution rate, which is a notable red flag for anyone expecting responsive help.

WP Compatibility

15/15

It requires PHP 7.4 and WordPress 5.6, and is tested with WordPress 7.0, giving it a modern compatibility profile.

Scores higher than 90% of indexed plugins

About

The ultimate companion for OceanWP. Adds local Google Fonts, mega menus, site templates, and per-page settings for total design authority.

Active Installs 500k+

Rating ★★★ 3.3/5

Last Updated 2026-09-21 9:27am GMT

Requires WordPress 5.9+

Tested Up To 7.1.2

Requires PHP 7.4+

Security History

21 known vulnerabilities, all patched

2 High 19 Medium

Most recent: April 30, 2026

View details ▸

Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter Medium

April 30, 2026 Patched in ["2.4.4"] CVE-2024-13362

Ocean Extra <= 2.5.3 - Missing Authorization Medium

April 7, 2026 Patched in ["2.5.4"] CVE-2026-34903

Ocean Extra <= 2.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via oceanwp_library Shortcode Medium

August 29, 2025 Patched in ["2.5.0"] CVE-2025-9499

Ocean Extra <= 2.4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting Medium

June 2, 2025 Patched in ["2.4.9"] CVE-2025-49068

Ocean Extra <= 2.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Medium

April 21, 2025 Patched in ["2.4.7"] CVE-2025-3457

Ocean Extra <= 2.4.6 - Unauthenticated Arbitrary Shortcode Execution Medium

April 21, 2025 Patched in ["2.4.7"] CVE-2025-3472

Ocean Extra <= 2.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'ocean_gallery_id' Medium

April 21, 2025 Patched in ["2.4.7"] CVE-2025-3458

Ocean Extra <= 2.2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting Medium

July 4, 2024 Patched in ["2.3.0"] CVE-2024-37489

Ocean Extra <= 2.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Flickr Widget Medium

June 10, 2024 Patched in ["2.2.9"] CVE-2024-5531

Ocean Extra <= 2.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting Medium

April 8, 2024 Patched in ["2.2.7"] CVE-2024-3167

Ocean Extra <= 2.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting Medium

February 16, 2024 Patched in ["2.2.5"] CVE-2024-1277

Ocean Extra <= 2.2.2 - Cross-Site Request Forgery to Arbitrary Plugin Activation Medium

November 28, 2023 Patched in ["2.2.3"] CVE-2023-49164

Freemius SDK <= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get Medium

July 18, 2023 Patched in ["2.1.8"] CVE-2023-33999

Ocean Extra <= 2.1.2 - Authenticated (Subscriber+) Arbitrary Post Access Medium

February 14, 2023 Patched in ["2.1.3"] CVE-2023-0749

Ocean Extra <= 2.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting Medium

February 14, 2023 Patched in ["2.1.3"] CVE-2023-24399

Ocean Extra <= 2.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Medium

February 1, 2023 Patched in ["2.1.2"] CVE-2023-23891

Ocean Extra <= 2.0.4 - Authenticated (Administrator+) PHP Object Injection High

October 10, 2022 Patched in ["2.0.5"] CVE-2022-3374

Ocean Extra <= 1.9.4 - Reflected Cross-Site Scripting Medium

May 24, 2022 Patched in ["1.9.5"] CVE-2021-25104

Freemius SDK <= 2.4.2 - Missing Authorization Checks Medium

March 4, 2022 Patched in ["1.9.4"] CVE-2022-4974

Ocean Extra <=1.6.5 - Cross-Site Request Forgery Bypass Medium

September 26, 2020 Patched in ["1.6.6"] CVE-2020-36760

Ocean Extra <= 1.5.7 - Unauthenticated Options update and CSS injection High

July 3, 2019 Patched in ["1.5.9"] CVE-2019-16250

What It Does

Ocean Extra is an add-on plugin that extends the OceanWP theme with practical features like local Google Fonts hosting, mega menu support, a library of pre-built site templates, and per-page layout settings that override global theme defaults. In practice, it lets OceanWP users build more complex navigation structures, import starter sites, and tweak individual pages without touching code.

Who It's For

This plugin is built specifically for sites already running the OceanWP theme who want to unlock its full design potential without installing a separate page builder. It suits freelancers, small business owners, and agencies running multi-page client sites that need mega menus, custom typography, and quick starter templates.

Who Should Skip It

Anyone not using OceanWP should skip this entirely, as most of its features are theme-locked and offer little value on other themes. Sites that already use a dedicated page builder like Elementor or a more general companion plugin will also find the overlap unnecessary.

The Bottom Line

Ocean Extra earns an overall quality score of 82.92 out of 100 and is a genuinely useful companion for OceanWP users, with strong maintenance and popularity numbers. The 0% support resolution rate across only 2 threads is a small sample size concern, but the plugin does what it promises well. It is a solid pick for OceanWP sites, and a non-starter for everyone else.

Related Plugins

Meta Box 87/100

Pick Meta Box if you need a more flexible and powerful custom fields framework that works with any theme.

SiteOrigin Widgets Bundle 87/100

Choose SiteOrigin when you want a broad widget library compatible with any theme, not just OceanWP.

One Click Demo Import 87/100

Pick One Click Demo Import if you only need demo content import functionality without the OceanWP-specific extras.

CMB2 87/100

Choose CMB2 for a developer-focused custom metabox toolkit that integrates with any theme or custom build.

Blocksy Companion 86/100

Pick Blocksy Companion if you use the Blocksy theme and want similar starter templates and header features tuned to that theme.