WordPress Plugin Vulnerabilities

BdThemes Multiple Plugins - XSS via 'display_id' from Sigmative API

Description

The Biggopti Library is vulnerable to Cross-Site Scripting via the 'display_id' parameter from the Sigmative API due to insufficient output escaping. This makes it possible for attackers who can compromise the Sigmative API server to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Affects Plugins

Plugin icon
bdthemes-prime-slider-lite
Fixed in 4.4.6
Plugin icon
smart-admin-assistant
Fixed in 2.2.1
Plugin icon
ultimate-post-kit
Fixed in 4.2.1
Plugin icon
pixel-gallery
Fixed in 2.1.15
Plugin icon
live-copy-paste
Fixed in 1.5.9
Plugin icon
bdthemes-element-pack-lite
Fixed in 8.7.15
Plugin icon
ultimate-store-kit
Fixed in 3.0.8

References

CVE
CVE-2026-92991
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/7bf1d6f9-afe2-41c2-968b-20dbc474cd73

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
5.4 (medium)

Miscellaneous

Verified
No
WPVDB ID
0bd5b5dc-b3d0-49d3-8837-1ec954754726

Timeline

Publicly Published
2026-08-08 (about 2 months ago)
Added
2026-09-17 (about 29 days ago)
Last Updated
2026-09-17 (about 29 days ago)

Other

Published
Title
Published
2023-10-11
Title
Copy Or Move Comments <= 5.0.4 - Reflected XSS
Published
2022-06-14
Title
ShortPixel Image Optimizer < 4.22.10 - Reflected Cross-Site Scripting
Published
2024-07-08
Title
Ultimate Classified Listings < 1.3 - Reflected XSS
Published
2021-11-02
Title
WP All Import < 3.6.3 - Admin+ Stored Cross-Site Scripting
Published
2025-01-16
Title
RS Survey <= 1.0 - Reflected Cross-Site Scripting