CVE-2026-92991
Biggopti Library (Various Versions) - Cross-Site Scripting via display_id from Sigmative API
- State
- Published
- Severity
- 5.4 Medium
- Published
- Sep 18, 2026
- Updated
- Sep 18, 2026
- Reserved
- Sep 17, 2026
Description
The Biggop Library is vulnerable to Cross-Site Scripting via the ‘display_id’ parameter from the Sigmative API in various versions due to insufficient output escaping. This makes it possible for attackers who can compromise the Sigmative API server to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 5.4 Medium | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N | Wordfence |
Weaknesses
- CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected Products
| Product | Versions |
|---|---|
Live Copy Paste for Elementor – Cross Domain Copy Paste & Page Duplicatorbdthemes |
|
Pixel Gallery Addons for Elementorbdthemes |
|
Smart Admin Assistantbdthemes |
|
Ultimate Store Kit – Store Builder Addons for Elementor, WooCommerce Store Builder, EDD Store Builderbdthemes |
|
Ultimate Post Kit – Elementor Post Grid, Post Carousel, Post Slider & Blog Layout Widgetsbdthemes |
|
Prime Slider – Hero Slider, Carousel, WooCommerce & Post Slider Elementor Addonsbdthemes |
|
Element Pack Addons for Elementor – Elementor Widgets, Elementor Templates, Elementor Addonsbdthemes |
|
References
- https://www.wordfence.com/threat-intel/vulnerabilities/id/7bf1d6f9-afe2-41c2-968b-20dbc474cd73?source=cve
- https://plugins.trac.wordpress.org/browser/bdthemes-element-pack-lite/tags/8.7.14/admin/assets/js/ep-admin-api-biggopti.min.js
- https://plugins.trac.wordpress.org/browser/ultimate-post-kit/tags/4.2.0/admin/assets/js/upk-admin-api-biggopti.min.js
- https://plugins.trac.wordpress.org/browser/live-copy-paste/tags/1.5.4/includes/promotion/biggopti/script.js
- https://plugins.trac.wordpress.org/browser/pixel-gallery/tags/2.1.14/admin/assets/js/pg-admin-api-biggopti.min.js
- https://plugins.trac.wordpress.org/browser/ultimate-store-kit/tags/3.0.7/assets/admin/others/js/admin-api-biggopti.js
- https://plugins.trac.wordpress.org/browser/bdthemes-prime-slider-lite/tags/4.4.5/admin/assets/js/ps-admin-api-biggopti.js
- https://plugins.trac.wordpress.org/browser/smart-admin-assistant/tags/2.2.0/includes/Admin/assets/js/biggopti.js
- https://plugins.trac.wordpress.org/changeset/3652687/live-copy-paste
- https://plugins.trac.wordpress.org/changeset/3639087/smart-admin-assistant
- https://plugins.trac.wordpress.org/changeset/3638677/pixel-gallery#file564
- https://plugins.trac.wordpress.org/changeset/3638663/ultimate-store-kit#file505
- https://plugins.trac.wordpress.org/changeset/3638660/ultimate-post-kit#file531
- https://plugins.trac.wordpress.org/changeset/3638625/bdthemes-prime-slider-lite#file428
- https://plugins.trac.wordpress.org/changeset/3638640/bdthemes-element-pack-lite#file1151
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.