Skip to content
CVE PROGRAM SOURCE RECORD5.4 Medium

CVE-2026-92991

Biggopti Library (Various Versions) - Cross-Site Scripting via display_id from Sigmative API

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Wordfence

Description

The Biggop Library is vulnerable to Cross-Site Scripting via the ‘display_id’ parameter from the Sigmative API in various versions due to insufficient output escaping. This makes it possible for attackers who can compromise the Sigmative API server to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

bdthemes Live Copy Paste for Elementor – Cross Domain Copy Paste & Page Duplicator

Default version status: unaffected

  • 0 to ≤ 1.5.6affected

bdthemes Pixel Gallery Addons for Elementor

Default version status: unaffected

  • 0 to ≤ 2.1.14affected

bdthemes Smart Admin Assistant

Default version status: unaffected

  • 0 to ≤ 2.2.0affected

bdthemes Ultimate Store Kit – Store Builder Addons for Elementor, WooCommerce Store Builder, EDD Store Builder

Default version status: unaffected

  • 0 to ≤ 3.0.7affected

bdthemes Ultimate Post Kit – Elementor Post Grid, Post Carousel, Post Slider & Blog Layout Widgets

Default version status: unaffected

  • 0 to ≤ 4.2.0affected

bdthemes Prime Slider – Hero Slider, Carousel, WooCommerce & Post Slider Elementor Addons

Default version status: unaffected

  • 0 to ≤ 4.4.5affected

bdthemes Element Pack Addons for Elementor – Elementor Widgets, Elementor Templates, Elementor Addons

Default version status: unaffected

  • 0 to ≤ 8.7.14affected

References