CVE-2026-3034: OoohBoi Steroids Elementor Plugin XSS Flaw

CVE-2026-3034 Overview

The OoohBoi Steroids for Elementor plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability in the URL parameter handling functionality. The vulnerability exists in the _ob_spacerat_link, _ob_bbad_link, and _ob_teleporter_link URL parameters across all versions up to and including 2.1.24. This security flaw allows authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts into WordPress pages. The malicious scripts execute whenever a user clicks on the compromised element, potentially leading to session hijacking, credential theft, or further attacks against site visitors.

Critical Impact

Authenticated attackers with Contributor-level access can inject persistent malicious scripts that execute in the context of other users' browsers, enabling session hijacking and phishing attacks.

Affected Products

• OoohBoi Steroids for Elementor plugin for WordPress versions up to and including 2.1.24
• WordPress sites running the vulnerable plugin with Contributor-level or higher user accounts

Discovery Timeline

• 2026-03-05 - CVE CVE-2026-3034 published to NVD
• 2026-03-05 - Last updated in NVD database

Technical Details for CVE-2026-3034

Vulnerability Analysis

This Stored Cross-Site Scripting vulnerability stems from insufficient input sanitization and output encoding in the OoohBoi Steroids for Elementor plugin. The plugin fails to properly validate and escape user-supplied data in three specific URL parameters: _ob_spacerat_link, _ob_bbad_link, and _ob_teleporter_link. When an authenticated user with Contributor-level privileges or above creates or modifies content using these parameters, the plugin stores the unsanitized input directly in the database. The malicious payload is then rendered without proper encoding when visitors interact with the affected page elements.

The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation), which represents the fundamental weakness enabling cross-site scripting attacks. The attack requires network access and low-privilege authentication, but once the malicious script is stored, it can affect any user who interacts with the compromised element.

Root Cause

The root cause lies in the plugin's JavaScript handling of URL parameters within the ooohboi-steroids.js and spacerat.js files. The vulnerable code paths at line 135, line 300 in ooohboi-steroids.js, and line 52 in spacerat.js process URL values without proper sanitization. The plugin trusts user input for these link parameters and renders them directly into the DOM, allowing JavaScript injection through crafted URL values containing script tags or event handlers.

Attack Vector

The attack is executed via network access, requiring the attacker to have at least Contributor-level authentication on the target WordPress site. The attacker crafts a malicious URL value containing JavaScript code within one of the vulnerable parameters (_ob_spacerat_link, _ob_bbad_link, or _ob_teleporter_link) and saves it through the Elementor editor interface. When the page is published and a visitor clicks on the injected element, the malicious script executes in their browser context.

The vulnerability allows cross-site impact, meaning scripts can access data and perform actions beyond the original security scope. An attacker could steal session cookies, redirect users to phishing sites, modify page content, or perform actions on behalf of the victim user. The stored nature of this XSS makes it particularly dangerous as the payload persists and can affect multiple users over time.

Detection Methods for CVE-2026-3034

Indicators of Compromise

• Presence of unexpected JavaScript code, encoded characters, or script tags within Elementor widget link settings containing _ob_spacerat_link, _ob_bbad_link, or _ob_teleporter_link parameters
• Database entries in WordPress post meta tables containing suspicious URL patterns with JavaScript payloads or event handlers
• User reports of unexpected browser behavior, pop-ups, or redirects when interacting with specific page elements
• New or modified content from Contributor-level accounts containing unusual link configurations

Detection Strategies

• Implement web application firewall (WAF) rules to detect and block XSS patterns in HTTP requests to WordPress admin endpoints
• Deploy endpoint detection and response (EDR) solutions to monitor for anomalous browser script execution originating from WordPress pages
• Configure log monitoring for WordPress admin actions, particularly content modifications involving Elementor widgets and the OoohBoi Steroids plugin
• Use automated vulnerability scanning tools to identify outdated plugin versions on WordPress installations

Monitoring Recommendations

• Enable WordPress audit logging to track all content changes made by Contributor-level and above users
• Monitor network traffic for unusual outbound connections from client browsers that may indicate data exfiltration
• Implement Content Security Policy (CSP) headers to detect and report inline script execution violations
• Regularly review plugin versions across WordPress deployments to ensure timely patching

How to Mitigate CVE-2026-3034

Immediate Actions Required

• Update OoohBoi Steroids for Elementor plugin to a version newer than 2.1.24 immediately
• Audit existing content created with the plugin for suspicious link parameters containing JavaScript code
• Review and restrict Contributor-level access to only trusted users until the patch is applied
• Enable Web Application Firewall protection with XSS filtering rules as a defense-in-depth measure

Patch Information

The vulnerability affects all versions of OoohBoi Steroids for Elementor up to and including 2.1.24. Site administrators should check the WordPress Plugin Developer Page for the latest patched version and apply the update through the WordPress admin dashboard. Additional vulnerability details are available through the Wordfence Vulnerability Intel database.

Workarounds

• If immediate patching is not possible, temporarily disable the OoohBoi Steroids for Elementor plugin until an update can be applied
• Restrict user registration and demote untrusted accounts from Contributor-level access to reduce the attack surface
• Implement strict Content Security Policy headers to mitigate the impact of any successfully injected scripts
• Deploy a Web Application Firewall configured to block common XSS attack patterns in request parameters

# WordPress CLI command to check plugin version
wp plugin list --name=ooohboi-steroids-for-elementor --format=table

# Update the plugin to the latest version
wp plugin update ooohboi-steroids-for-elementor

# Temporarily deactivate plugin if update is not available
wp plugin deactivate ooohboi-steroids-for-elementor