Pixel Gallery Addons For Elementor
Monthly
Cross-site scripting in the shared Biggop promotional library bundled with seven bdthemes Elementor plugins - Element Pack Addons for Elementor ≤8.7.14, Prime Slider ≤4.4.5, Ultimate Post Kit ≤4.2.0, Ultimate Store Kit ≤3.0.7, Pixel Gallery ≤2.1.14, Live Copy Paste ≤1.5.6, and Smart Admin Assistant ≤2.2.0 - allows arbitrary script injection through the unescaped 'display_id' value returned by the external Sigmative/Biggop API. Exploitation is not trivial: an attacker must first compromise or impersonate that third-party API server, and a victim (typically a logged-in administrator) must then load the plugin admin page that renders the tainted API response through the biggopti JavaScript. There is no confirmed active exploitation (not listed in CISA KEV) and no public exploit code identified at time of analysis; the CVSS 5.4 score reflects high attack complexity (AC:H) and the scope change rather than a directly reachable flaw in the plugin itself.
Cross-site scripting in the shared Biggop promotional library bundled with seven bdthemes Elementor plugins - Element Pack Addons for Elementor ≤8.7.14, Prime Slider ≤4.4.5, Ultimate Post Kit ≤4.2.0, Ultimate Store Kit ≤3.0.7, Pixel Gallery ≤2.1.14, Live Copy Paste ≤1.5.6, and Smart Admin Assistant ≤2.2.0 - allows arbitrary script injection through the unescaped 'display_id' value returned by the external Sigmative/Biggop API. Exploitation is not trivial: an attacker must first compromise or impersonate that third-party API server, and a victim (typically a logged-in administrator) must then load the plugin admin page that renders the tainted API response through the biggopti JavaScript. There is no confirmed active exploitation (not listed in CISA KEV) and no public exploit code identified at time of analysis; the CVSS 5.4 score reflects high attack complexity (AC:H) and the scope change rather than a directly reachable flaw in the plugin itself.