CVE-2026-3034: 
WordPress vulnerability analysis and mitigation

CVE-2026-3034 is a Stored Cross-Site Scripting (XSS) vulnerability in the OoohBoi Steroids for Elementor WordPress plugin. It affects all versions up to and including 2.1.24, allowing authenticated attackers with Contributor-level access or above to inject arbitrary web scripts via the _ob_spacerat_link, _ob_bbad_link, and _ob_teleporter_link URL parameters. The injected scripts execute in the context of any user who clicks on the affected element. It carries a CVSS v3.1 base score of 6.4 (Medium) (Wordfence, Red Hat CVE).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting). The root cause is insufficient sanitization and validation of URL parameters (_ob_spacerat_link, _ob_bbad_link, _ob_teleporter_link) processed by the plugin's JavaScript files (spacerat.js and ooohboi-steroids.js). An attacker with at least Contributor-level WordPress access can craft a malicious URL value that is stored in the database and later rendered unsanitized in page output, triggering script execution when a visitor interacts with the injected element (Wordfence, WordPress Plugin Trac).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the browsers of site visitors or administrators who interact with the compromised page element. This can lead to session cookie theft, credential harvesting, defacement of page content, or redirection to malicious sites. While availability is not directly impacted, the confidentiality and integrity of user sessions and site content are at risk. The changed scope (S:C) indicates the impact can extend beyond the plugin itself to the broader WordPress site and its users (Wordfence).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been reported as of the time of disclosure. The EPSS score is approximately 0.032%, indicating a low probability of exploitation in the near term. The vulnerability requires authenticated access at the Contributor level or above, which limits the attack surface compared to unauthenticated vulnerabilities. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Wordfence, Red Hat CVE).

1. Reconnaissance: Identify WordPress sites using the OoohBoi Steroids for Elementor plugin (version ≤ 2.1.24) via WPScan, Shodan, or manual inspection of page source for plugin-specific assets.
2. Obtain Contributor Access: Register or compromise a Contributor-level (or higher) WordPress account on the target site.
3. Create or Edit a Page/Post: Using the Elementor editor, add a widget or element that utilizes one of the vulnerable parameters (_ob_spacerat_link, _ob_bbad_link, or _ob_teleporter_link).
4. Inject Malicious Payload: Set the URL parameter value to a JavaScript payload, e.g., javascript:alert(document.cookie) or a more sophisticated payload that exfiltrates session cookies to an attacker-controlled server.
5. Publish Content: Save and publish the page. The malicious script is now stored in the WordPress database.
6. Trigger Execution: When a site visitor or administrator clicks on the injected element, the stored XSS payload executes in their browser, enabling session hijacking, credential theft, or further attacks (Wordfence, WordPress Plugin Trac).

• Database/Content: WordPress post or page content containing JavaScript payloads (e.g., <script>, javascript:, onerror=, onmouseover=) within _ob_spacerat_link, _ob_bbad_link, or _ob_teleporter_link meta fields.
• Logs: WordPress access logs showing authenticated POST requests to wp-admin/post.php or REST API endpoints with suspicious URL-encoded JavaScript in widget/element parameters.
• Network: Outbound requests from victim browsers to unknown external domains shortly after page interaction, potentially carrying cookie or session data in query parameters.
• File System: No direct file system artifacts expected for stored XSS; however, review Elementor-saved templates and post meta in the WordPress database for unexpected script content.

Site administrators should update the OoohBoi Steroids for Elementor plugin to a version beyond 2.1.24 that includes a fix for this vulnerability. Check the plugin's changelog for the patched release. As an interim measure, restrict Contributor-level user registrations or limit who can create/edit content using Elementor widgets. Web Application Firewalls (WAFs) with XSS filtering rules can provide additional defense-in-depth (Wordfence, WordPress Plugin Page).

The vulnerability was assigned and disclosed by Wordfence, a leading WordPress security firm, and published on March 5, 2026. It was subsequently indexed by ENISA's EUVD (EUVD-2026-9525) and referenced by Red Hat's CVE database. No significant independent researcher commentary or broad media coverage has been identified beyond standard vulnerability aggregator listings (Wordfence, Red Hat CVE).