CVE-2026-3034

The OoohBoi Steroids for Elementor WordPress plugin, up to version 2.1.24, fails to properly sanitize the _ob_spacerat_link, _ob_bbad_link, and _ob_teleporter_link URL parameters. This allows authenticated users with at least Contributor-level access to inject arbitrary web scripts into pages via these fields [1].

Exploitation requires an attacker to have a WordPress account with Contributor privileges or higher. The attacker can save a post or page containing malicious JavaScript in any of the three vulnerable parameters. The injected script is stored on the server and executes when an unsuspecting user clicks on the element (such as a link or button) that uses the compromised parameter [1].

If exploited, the attacker can perform a wide range of actions within the context of the victim’s session, including stealing cookies, redirecting to malicious sites, or modifying page content. Because the XSS is stored, every visitor who clicks the affected element is a potential target [1].

As of version 2.1.24, the developer has not released a patch; users are advised to update to the latest available version and to restrict Contributor-level access to trusted users only [1].