Ooohboi Steroids For Elementor Vulnerabilities

Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple URL Controls vulnerability

CVSS:

6.5

Affected:

up to 2.1.24

Fixed in:

2.1.25

Disclosed:

Mar 4, 2026

The OoohBoi Steroids for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the _ob_spacerat_link, _ob_bbad_link, and _ob_teleporter_link URL parameters in all versions up to, and including, 2.1.24. This makes it possible for authenticated attackers, with Contributor-level access and above,...

CVSS:

6.4

Affected:

up to 2.1.24

Fixed in:

2.1.25

Disclosed:

Mar 4, 2026

CVE-2026-3034 on NVD →

The OoohBoi Steroids for Elementor plugin for WordPress is vulnerable to missing authorization due to a missing capability check on the 'file_uploader_callback' function in versions up to, and including, 2.1.4. This makes it possible for subscriber-level attackers to upload image attachments to the site.

CVSS:

4.3

Affected:

up to 2.1.4

Fixed in:

2.1.5

Disclosed:

Apr 18, 2023

CVE-2023-1169 on NVD →

The OoohBoi Steroids for Elementor plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'file_batch_delete_callback' function in versions up to, and including, 2.1.3. This makes it possible for subscriber-level attackers to delete attachments.

CVSS:

4.3

Affected:

up to 2.1.3

Fixed in:

2.1.5

Disclosed:

Feb 28, 2023

CVE-2023-0336 on NVD →