CVE-2026-92991
Last modified
CVE-2026-92991 is a medium-severity vulnerability rated 5.4/10 on the CVSS scale. The Biggop Library is vulnerable to Cross-Site Scripting via the ‘display_id’ parameter from the Sigmative API in various versions due to insufficient output escaping. This makes it possible for attackers who can compromise the Sigmative API server to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page..
Description
The Biggop Library is vulnerable to Cross-Site Scripting via the ‘display_id’ parameter from the Sigmative API in various versions due to insufficient output escaping. This makes it possible for attackers who can compromise the Sigmative API server to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| bdthemes | Live Copy Paste for Elementor – Cross Domain Copy Paste & Page Duplicator | <= 1.5.6 |
| bdthemes | Pixel Gallery Addons for Elementor | <= 2.1.14 |
| bdthemes | Smart Admin Assistant | <= 2.2.0 |
| bdthemes | Ultimate Store Kit – Store Builder Addons for Elementor, WooCommerce Store Builder, EDD Store Builder | <= 3.0.7 |
| bdthemes | Ultimate Post Kit – Elementor Post Grid, Post Carousel, Post Slider & Blog Layout Widgets | <= 4.2.0 |
| bdthemes | Prime Slider – Hero Slider, Carousel, WooCommerce & Post Slider Elementor Addons | <= 4.4.5 |
| bdthemes | Element Pack Addons for Elementor – Elementor Widgets, Elementor Templates, Elementor Addons | <= 8.7.14 |
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-92991?
How severe is CVE-2026-92991?
How do I fix CVE-2026-92991?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-92985SiYuan versions before 3.8.4 fail to escape bookmark labels …8.8
- CVE-2026-92986SiYuan before 3.8.4 renders document titles as HTML in the b…8.8
- CVE-2026-92987roxmltree through 0.21.1 performs quadratic-time attribute a…7.5
- CVE-2026-92989The SendPress Newsletters WordPress plugin through 1.26.1.20…4.3
- CVE-2026-9299A flaw has been found in omec-project amf up to 2.1.1. Affec…6.3
- CVE-2026-92990The SendPress Newsletters WordPress plugin through 1.26.1.20…5.3
- CVE-2026-92992A security vulnerability has been detected in Dromara mayfly…6.3
- CVE-2026-92993A vulnerability was detected in Dromara mayfly-go up to 1.11…6.3
- CVE-2026-92994The Verge3D Publishing and E-Commerce WordPress plugin befor…8.8
- CVE-2026-92995The Verge3D Publishing and E-Commerce WordPress plugin throu…5.3
- CVE-2026-92996The Verge3D WordPress plugin from 4.1.0 through 4.13.0 does …5.3
- CVE-2026-92997The Click n Chat (Chat Widget Integration) WordPress plugin …8.6
Are you affected by CVE-2026-92991?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST