Biggopti Library (Various Versions) - Cross-Site Scripting via display_id from Sigmative API
Priority LOW 25CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.
Summary
The Biggop Library is vulnerable to Cross-Site Scripting via the ‘display_id’ parameter from the Sigmative API in various versions due to insufficient output escaping. This makes it possible for attackers who can compromise the Sigmative API server to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0043 37th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| bdthemes | Live Copy Paste for Elementor – Cross Domain Copy Paste & Page Duplicator | up to 1.5.6 | — | No fix listed | CNA |
| bdthemes | Pixel Gallery Addons for Elementor | up to 2.1.14 | — | No fix listed | CNA |
| bdthemes | Smart Admin Assistant | up to 2.2.0 | — | No fix listed | CNA |
| bdthemes | Ultimate Store Kit – Store Builder Addons for Elementor, WooCommerce Store Builder, EDD Store Builder | up to 3.0.7 | — | No fix listed | CNA |
| bdthemes | Ultimate Post Kit – Elementor Post Grid, Post Carousel, Post Slider & Blog Layout Widgets | up to 4.2.0 | — | No fix listed | CNA |
| bdthemes | Prime Slider – Hero Slider, Carousel, WooCommerce & Post Slider Elementor Addons | up to 4.4.5 | — | No fix listed | CNA |
| bdthemes | Element Pack Addons for Elementor – Elementor Widgets, Elementor Templates, Elementor Addons | up to 8.7.14 | — | No fix listed | CNA |
- Live Copy Paste for Elementor – Cross Domain Copy Paste & Page Duplicator Vendorbdthemes Affected up to 1.5.6 Fixed in — No fix listed CNA
- Pixel Gallery Addons for Elementor Vendorbdthemes Affected up to 2.1.14 Fixed in — No fix listed CNA
- Smart Admin Assistant Vendorbdthemes Affected up to 2.2.0 Fixed in — No fix listed CNA
- Ultimate Store Kit – Store Builder Addons for Elementor, WooCommerce Store Builder, EDD Store Builder Vendorbdthemes Affected up to 3.0.7 Fixed in — No fix listed CNA
- Ultimate Post Kit – Elementor Post Grid, Post Carousel, Post Slider & Blog Layout Widgets Vendorbdthemes Affected up to 4.2.0 Fixed in — No fix listed CNA
- Prime Slider – Hero Slider, Carousel, WooCommerce & Post Slider Elementor Addons Vendorbdthemes Affected up to 4.4.5 Fixed in — No fix listed CNA
- Element Pack Addons for Elementor – Elementor Widgets, Elementor Templates, Elementor Addons Vendorbdthemes Affected up to 8.7.14 Fixed in — No fix listed CNA
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2026-92991
- 2026-10-03 Alias added: GHSA-hwvr-ccch-hg6f
References
Other 15
- https://www.wordfence.com/threat-intel/vulnerabilities/id/7bf1d6f9-afe2-41c2-968b-20dbc474cd73?source=cve
- https://plugins.trac.wordpress.org/browser/bdthemes-element-pack-lite/tags/8.7.14/admin/assets/js/ep-admin-api-biggopti.min.js
- https://plugins.trac.wordpress.org/browser/ultimate-post-kit/tags/4.2.0/admin/assets/js/upk-admin-api-biggopti.min.js
- https://plugins.trac.wordpress.org/browser/live-copy-paste/tags/1.5.4/includes/promotion/biggopti/script.js
- https://plugins.trac.wordpress.org/browser/pixel-gallery/tags/2.1.14/admin/assets/js/pg-admin-api-biggopti.min.js
- https://plugins.trac.wordpress.org/browser/ultimate-store-kit/tags/3.0.7/assets/admin/others/js/admin-api-biggopti.js
- https://plugins.trac.wordpress.org/browser/bdthemes-prime-slider-lite/tags/4.4.5/admin/assets/js/ps-admin-api-biggopti.js
- https://plugins.trac.wordpress.org/browser/smart-admin-assistant/tags/2.2.0/includes/Admin/assets/js/biggopti.js
- https://plugins.trac.wordpress.org/changeset/3652687/live-copy-paste
- https://plugins.trac.wordpress.org/changeset/3639087/smart-admin-assistant
- https://plugins.trac.wordpress.org/changeset/3638677/pixel-gallery#file564
- https://plugins.trac.wordpress.org/changeset/3638663/ultimate-store-kit#file505
- https://plugins.trac.wordpress.org/changeset/3638660/ultimate-post-kit#file531
- https://plugins.trac.wordpress.org/changeset/3638625/bdthemes-prime-slider-lite#file428
- https://plugins.trac.wordpress.org/changeset/3638640/bdthemes-element-pack-lite#file1151
More bdthemes vulnerabilities
- TI-2024-10178 Element Pack Elementor Addons < 5.10.3 - Contributor+ Stored XSS CVSS 3.1MEDIUM 5.4
- TI-2024-09719 Element Pack Elementor Addons < 5.10.3 - Contributor+ Stored XSS CVSS 3.1MEDIUM 5.4
- TI-2026-54684 SigmaForms Pro <= 1.4.11 - Unauthenticated Arbitrary File Deletion via Path Traversal in File Upload Field CVSS 3.1CRITICAL 9.8
- TI-2026-12244 Unrestricted file upload in bdthemes SigmaForms Pro – AI Generated Forms CVSS 3.1CRITICAL 9.8
- TI-2024-07444 Deserialization of untrusted data in bdthemes Ultimate Store Kit – Addon For WooCommerce… CVSS 3.1CRITICAL 9.8
- TI-2025-26330 WordPress Ultimate Store Kit Elementor Addons plugin <= 2.4.0 - Deserialization of untrusted data Vulnerability CVSS 3.1CRITICAL 9.8
Sources
- CVE-2026-92991 · CVE Program
- CVE-2026-92991 · NVD
- FIRST EPSS
- GHSA-hwvr-ccch-hg6f · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences