CVE-2026-92991 PUBLISHED

Biggopti Library (Various Versions) - Cross-Site Scripting via display_id from Sigmative API

Assigner: Wordfence
Reserved: 17.09.2026 Published: 18.09.2026 Updated: 18.09.2026

The Biggop Library is vulnerable to Cross-Site Scripting via the ‘display_id’ parameter from the Sigmative API in various versions due to insufficient output escaping. This makes it possible for attackers who can compromise the Sigmative API server to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
CVSS Score: 5.4

Product Status

Vendor bdthemes
Product Live Copy Paste for Elementor – Cross Domain Copy Paste & Page Duplicator
Versions Default: unaffected
  • affected from 0 to 1.5.6 (incl.)
Vendor bdthemes
Product Pixel Gallery Addons for Elementor
Versions Default: unaffected
  • affected from 0 to 2.1.14 (incl.)
Vendor bdthemes
Product Smart Admin Assistant
Versions Default: unaffected
  • affected from 0 to 2.2.0 (incl.)
Vendor bdthemes
Product Ultimate Store Kit – Store Builder Addons for Elementor, WooCommerce Store Builder, EDD Store Builder
Versions Default: unaffected
  • affected from 0 to 3.0.7 (incl.)
Vendor bdthemes
Product Ultimate Post Kit – Elementor Post Grid, Post Carousel, Post Slider & Blog Layout Widgets
Versions Default: unaffected
  • affected from 0 to 4.2.0 (incl.)
Vendor bdthemes
Product Prime Slider – Hero Slider, Carousel, WooCommerce & Post Slider Elementor Addons
Versions Default: unaffected
  • affected from 0 to 4.4.5 (incl.)
Vendor bdthemes
Product Element Pack Addons for Elementor – Elementor Widgets, Elementor Templates, Elementor Addons
Versions Default: unaffected
  • affected from 0 to 8.7.14 (incl.)

References

Problem Types

  • CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE