Poisoned API Feed Compromised BdThemes WordPress Plugins via Admin XSS

A supply-chain attack hit multiple BdThemes WordPress plugins after attackers poisoned JSON returned by the Biggopti promotional banner component, causing malicious JavaScript to execute in authenticated wp-admin sessions. The issue stemmed from unsafe handling of the display_id field, creating an admin-side cross-site scripting condition without any need to modify plugin files in the WordPress.org repository. Reported affected plugins included Element Pack Addons for Elementor, Prime Slider Addons for Elementor, Pixel Gallery, Ultimate Post Kit, Ultimate Store Kit, Live Copy Paste for Elementor, and Smart Admin Assistant.

The malicious feed was reportedly served from a DigitalOcean Spaces bucket behind Cloudflare and was used to create rogue administrator accounts, install a fake plugin containing a webshell, deploy must-use plugin backdoors for persistence and stealth, and exfiltrate results to a command-and-control server. Researchers said the campaign may have started as early as June 23, 2026, was observed in the wild on August 7, and the poisoned endpoints were cleaned on August 8, but the vulnerability remained unpatched at the time of reporting and site owners were urged to check for lingering compromise artifacts.