CVE-2026-3034 is a stored cross-site scripting vulnerability (CWE-79) in the OoohBoi Steroids for Elementor WordPress plugin. It arises from improper neutralization of input during web page generation, specifically through the _ob_spacerat_link, _ob_bbad_link, and _ob_teleporter_link URL parameters. Authenticated attackers with at least Contributor privileges can inject arbitrary web scripts that execute when users click on the injected elements. This vulnerability affects all plugin versions up to and including 2.1.24. The CVSS 3.1 base score is 6.4, reflecting network attack vector, low attack complexity, required privileges, no user interaction, and impacts on confidentiality and integrity with no availability impact. There is no indication of known exploits in the wild or available patches.

Successful exploitation allows authenticated users with Contributor-level access or higher to inject and execute arbitrary scripts in the context of the affected website. This can lead to partial compromise of confidentiality and integrity of user data or site content. The vulnerability does not affect availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Contributor-level access to trusted users only and consider monitoring for suspicious activity related to the vulnerable URL parameters. Avoid clicking on untrusted links containing the affected parameters. Do not rely on generic mitigations unless specifically recommended by the vendor.