CVEvulnerability
CVE-2026-92991
5.4 MEDIUM
Official page ↗
- Status
- Deferred
- Published
- 2026-09-18
- Last modified
- 2026-09-18
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 5.4 MEDIUM — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
- Weaknesses
- CWE-79
Description
The Biggop Library is vulnerable to Cross-Site Scripting via the ‘display_id’ parameter from the Sigmative API in various versions due to insufficient output escaping. This makes it possible for attackers who can compromise the Sigmative API server to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Related
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- https://plugins.trac.wordpress.org/browser/bdthemes-element-pack-lite/tags/8.7.14/admin/assets/js/ep-admin-api-biggopti.min.js plugins.trac.wordpress.org
- https://plugins.trac.wordpress.org/browser/bdthemes-prime-slider-lite/tags/4.4.5/admin/assets/js/ps-admin-api-biggopti.js plugins.trac.wordpress.org
- https://plugins.trac.wordpress.org/browser/live-copy-paste/tags/1.5.4/includes/promotion/biggopti/script.js plugins.trac.wordpress.org
- https://plugins.trac.wordpress.org/browser/pixel-gallery/tags/2.1.14/admin/assets/js/pg-admin-api-biggopti.min.js plugins.trac.wordpress.org
- https://plugins.trac.wordpress.org/browser/smart-admin-assistant/tags/2.2.0/includes/Admin/assets/js/biggopti.js plugins.trac.wordpress.org
- https://plugins.trac.wordpress.org/browser/ultimate-post-kit/tags/4.2.0/admin/assets/js/upk-admin-api-biggopti.min.js plugins.trac.wordpress.org
- https://plugins.trac.wordpress.org/browser/ultimate-store-kit/tags/3.0.7/assets/admin/others/js/admin-api-biggopti.js plugins.trac.wordpress.org
- https://plugins.trac.wordpress.org/changeset/3638625/bdthemes-prime-slider-lite#file428 plugins.trac.wordpress.org
- https://plugins.trac.wordpress.org/changeset/3638640/bdthemes-element-pack-lite#file1151 plugins.trac.wordpress.org
- https://plugins.trac.wordpress.org/changeset/3638660/ultimate-post-kit#file531 plugins.trac.wordpress.org
- https://plugins.trac.wordpress.org/changeset/3638663/ultimate-store-kit#file505 plugins.trac.wordpress.org
- https://plugins.trac.wordpress.org/changeset/3638677/pixel-gallery#file564 plugins.trac.wordpress.org
- https://plugins.trac.wordpress.org/changeset/3639087/smart-admin-assistant plugins.trac.wordpress.org
- https://plugins.trac.wordpress.org/changeset/3652687/live-copy-paste plugins.trac.wordpress.org
- https://www.wordfence.com/threat-intel/vulnerabilities/id/7bf1d6f9-afe2-41c2-968b-20dbc474cd73?source=cve www.wordfence.com