The Biggop Library component within bdthemes Live Copy Paste for Elementor is vulnerable to a cross-site scripting issue due to insufficient output escaping of the 'display_id' parameter from the Sigmative API. This vulnerability enables attackers with control over the Sigmative API server to inject arbitrary web scripts into pages, which execute in the context of users visiting those pages. The vulnerability affects multiple versions of the product up to and including 8.7.14. The CVSS 3.1 base score is 5.4, reflecting a medium severity with network attack vector, high attack complexity, no privileges required, no user interaction, and partial impact on confidentiality and integrity.

Successful exploitation allows an attacker who has compromised the Sigmative API server to inject and execute arbitrary scripts in the context of users visiting affected pages. This can lead to partial disclosure of confidential information and modification of data within the affected web application context. There is no impact on availability. The vulnerability requires high attack complexity and no privileges or user interaction, limiting the ease of exploitation.

No official patch or fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should monitor vendor communications for updates. Since exploitation requires compromise of the Sigmative API server, securing that API and limiting its exposure may reduce risk.