PT-2026-23131 · WordPress · Ooohboi Steroids For Elementor

Posimyththemes · Publicado 2026-03-05 · Atualizado 2026-03-08 · CVE-2026-3034

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions OoohBoi Steroids for Elementor plugin for WordPress versions up to and including 2.1.24

Description The OoohBoi Steroids for Elementor plugin for WordPress contains a Stored Cross-Site Scripting issue. Authenticated attackers with Contributor-level access or higher can inject arbitrary web scripts into pages. This occurs through the ob spacerat link, ob bbad link, and ob teleporter link URL parameters. When a user clicks on the injected element, the script will execute.

Recommendations Update OoohBoi Steroids for Elementor plugin to a version later than 2.1.24.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2026-3034

Produtos afetados

Ooohboi Steroids For Elementor

Referências · 11

• https://t.me/CVEtracker/46407 · Publicação no Telegram
• https://twitter.com/VulmonFeeds/status/2029433645199474722 · Publicação no Twitter
• https://twitter.com/cyberbivash/status/2029424847042797572 · Publicação no Twitter
• https://plugins.trac.wordpress.org/browser/ooohboi-steroids-for-elementor/tags/2.1.24/assets/js/spacerat.js#L52 · Nota
• https://plugins.trac.wordpress.org/browser/ooohboi-steroids-for-elementor/tags/2.1.24/assets/js/ooohboi-steroids.js#L300 · Nota
• https://wordpress.org/plugins/ooohboi-steroids-for-elementor/#developers · Nota
• https://twitter.com/CVEnew/status/2030755414824886518 · Publicação no Twitter
• https://t.me/cveNotify/154267 · Publicação no Telegram
• https://wordfence.com/threat-intel/vulnerabilities/id/9c2de78e-8530-416b-adef-e2e8ff322802?source=cve · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-3034 · Nota de Segurança
• https://plugins.trac.wordpress.org/browser/ooohboi-steroids-for-elementor/tags/2.1.24/assets/js/ooohboi-steroids.js#L135 · Nota