PT-2026-23131 · WordPress · Ooohboi Steroids For Elementor

Posimyththemes · Published 2026-03-05 · Updated 2026-03-08 · CVE-2026-3034

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions OoohBoi Steroids for Elementor plugin for WordPress versions up to and including 2.1.24

Description The OoohBoi Steroids for Elementor plugin for WordPress contains a Stored Cross-Site Scripting issue. Authenticated attackers with Contributor-level access or higher can inject arbitrary web scripts into pages. This occurs through the ob spacerat link, ob bbad link, and ob teleporter link URL parameters. When a user clicks on the injected element, the script will execute.

Recommendations Update OoohBoi Steroids for Elementor plugin to a version later than 2.1.24.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-3034

Affected Products

Ooohboi Steroids For Elementor

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2026-3034 · Security Note
• https://t.me/CVEtracker/46407 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2029433645199474722 · Twitter Post
• https://twitter.com/cyberbivash/status/2029424847042797572 · Twitter Post
• https://plugins.trac.wordpress.org/browser/ooohboi-steroids-for-elementor/tags/2.1.24/assets/js/spacerat.js#L52 · Note
• https://plugins.trac.wordpress.org/browser/ooohboi-steroids-for-elementor/tags/2.1.24/assets/js/ooohboi-steroids.js#L300 · Note
• https://wordpress.org/plugins/ooohboi-steroids-for-elementor/#developers · Note
• https://twitter.com/CVEnew/status/2030755414824886518 · Twitter Post
• https://t.me/cveNotify/154267 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/9c2de78e-8530-416b-adef-e2e8ff322802?source=cve · Note
• https://plugins.trac.wordpress.org/browser/ooohboi-steroids-for-elementor/tags/2.1.24/assets/js/ooohboi-steroids.js#L135 · Note