CVE-2026-81929

Name of the Vulnerable Software and Affected Versions Ocean Pro Demos versions prior to 1.5.5 Ocean eComm Treasure Box versions prior to 1.8.1

Description Stored Cross-Site Scripting occurs due to insufficient authorization, input sanitization, and output escaping in the Popup Builder's save popup content AJAX action. Unauthenticated attackers can inject arbitrary web scripts via the content parameter into a published Gutenberg popup. These scripts execute when a user visits a page where the popup is configured to display. This issue requires a valid premium license, the Popup Builder module, and at least one published Gutenberg popup configured for display.

Recommendations Update Ocean Pro Demos to version 1.5.5 or later. Update Ocean eComm Treasure Box to version 1.8.1 or later.