Executive brief
The Biggop Library, a software component used by WordPress plugins and other web applications, fails to properly sanitize user-controlled input from the Sigmative API. An attacker who compromises the Sigmative API server can inject malicious scripts that execute in users' browsers when they visit affected pages, potentially stealing session credentials, personal data, or redirecting users to malicious sites.
Technical details
The vulnerability is a stored cross-site scripting (XSS) flaw in the Biggop Library's handling of the 'display_id' parameter received from the Sigmative API. The root cause is insufficient output escaping when rendering this parameter in web pages. The attack vector requires compromise of the upstream Sigmative API server, making this an API-layer supply-chain risk rather than a direct input validation issue. When a user accesses a page that fetches data from the compromised Sigmative API, the injected script executes with the privileges of the user's session. Patches or fixes should be available from the library maintainers and dependent plugins.
Affected products
- BDThemes Element Pack Lite 8.7.14 and potentially others
- BDThemes Prime Slider Lite 4.4.5 and potentially others
- Biggop Library various versions
Timeline
- 2026-09-18: disclosed