CVE-2026-92991: Biggop Library XSS Vulnerability

CVE-2026-92991 is a cross-site scripting flaw in Biggop Library affecting the display_id parameter from Sigmative API. Attackers can inject malicious scripts that execute in user browsers. This article covers technical details, affected versions, impact assessment, and recommended mitigation strategies.

CVE-2026-92991 Overview

CVE-2026-92991 is a Cross-Site Scripting (XSS) vulnerability [CWE-79] in the Biggop Library, which is bundled with several WordPress plugins including bdthemes-element-pack-lite, bdthemes-prime-slider-lite, live-copy-paste, pixel-gallery, smart-admin-assistant, ultimate-post-kit, and ultimate-store-kit. The flaw exists in how the library handles the display_id parameter returned from the Sigmative API. Insufficient output escaping allows arbitrary web script injection into rendered pages. An attacker who can control or compromise the Sigmative API server can inject scripts that execute when administrators view the affected page.

Critical Impact
An attacker able to compromise the upstream Sigmative API can inject arbitrary JavaScript into WordPress admin pages using the Biggop Library, leading to session theft, redirection, and administrative action abuse.

Affected Products

bdthemes-element-pack-lite (fixed in 8.7.14) and bdthemes-prime-slider-lite (fixed in 4.4.5)
ultimate-post-kit (fixed in 4.2.0), ultimate-store-kit (fixed in 3.0.7), and pixel-gallery (fixed in 2.1.14)
smart-admin-assistant (fixed in 2.2.0) and live-copy-paste (fixed in 1.5.4)

Discovery Timeline

2026-09-18 - CVE-2026-92991 published to NVD
2026-09-18 - Last updated in NVD database

Technical Details for CVE-2026-92991

Vulnerability Analysis

The Biggop Library is a shared component embedded in multiple WordPress plugins to fetch promotional or template content from the third-party Sigmative API. When the API response is rendered into administrative pages, the display_id field is written to the DOM without proper escaping. Because the value originates from an external source rather than the WordPress database, standard content filtering does not apply. An attacker who controls the Sigmative API response body, either by compromising the API server or by intercepting network traffic under favorable conditions, can substitute the display_id value with an HTML or JavaScript payload. When a WordPress administrator loads the plugin's admin screen, the injected script executes in the browser under the administrator's session context.

Root Cause

The root cause is missing output encoding on data received from an external API before insertion into the HTML DOM. The client-side scripts shipped with the affected plugins (for example ep-admin-api-biggopti.min.js and ps-admin-api-biggopti.js) consume the display_id field from the Sigmative API response and render it directly, violating the principle of treating all external input as untrusted [CWE-79].

Attack Vector

Exploitation requires an attacker to influence the response served by the Sigmative API. The attack does not require WordPress authentication, but does depend on a WordPress administrator subsequently loading a plugin admin page that invokes the Biggop Library. Once executed, injected scripts run in the administrator's browser and can perform any action the administrator is authorized to perform, including creating users, modifying plugins, or exfiltrating nonces. Refer to the Wordfence Vulnerability Report for additional technical context.

Detection Methods for CVE-2026-92991

Indicators of Compromise

Unexpected outbound requests from WordPress admin sessions to unknown domains following visits to affected plugin admin pages.
Sigmative API responses containing HTML tags, <script> elements, or JavaScript event handlers in the display_id field.
Creation of new administrator accounts or plugin installations shortly after admin access to a Biggop-enabled screen.

Detection Strategies

Inspect network traffic to and from the Sigmative API endpoint and log the raw JSON responses for offline review.
Review WordPress audit logs for administrative actions performed immediately after loading pages that call the Biggop Library scripts.
Scan installed plugin versions against the fixed versions listed in the affected products section.

Monitoring Recommendations

Alert on WordPress admin sessions that trigger script errors or Content Security Policy violations on Biggop-related admin pages.
Monitor for changes to WordPress user roles, options, and installed plugins that lack a corresponding user-initiated request.
Track outbound DNS and HTTP requests from admin browsers for suspicious redirects following plugin page visits.

How to Mitigate CVE-2026-92991

Immediate Actions Required

Update bdthemes-element-pack-lite to 8.7.14, bdthemes-prime-slider-lite to 4.4.5, ultimate-post-kit to 4.2.0, ultimate-store-kit to 3.0.7, pixel-gallery to 2.1.14, smart-admin-assistant to 2.2.0, and live-copy-paste to 1.5.4.
Audit WordPress administrator accounts and installed plugins for unauthorized changes.
Rotate session cookies and administrator passwords if any affected plugin was in use before patching.

Patch Information

Patches are available in the WordPress plugin repository. See the changesets 3638625 (prime-slider-lite), 3638640 (element-pack-lite), 3638660 (ultimate-post-kit), 3638663 (ultimate-store-kit), 3638677 (pixel-gallery), 3639087 (smart-admin-assistant), and 3652687 (live-copy-paste). The fixes add proper output escaping to the Biggop Library scripts before inserting API response fields into the DOM.

Workarounds

Deactivate all affected plugins until they are updated to the fixed versions listed above.
Restrict WordPress administrator access to trusted networks to reduce the exposure window for injected scripts.
Implement a strict Content Security Policy in the WordPress admin interface to limit inline script execution and untrusted script sources.