CVE-2026-92991: Biggopti Library (Various Versions) - Cross-Site Scripting via display_id from Sigmative API

Description

The Biggop Library is vulnerable to Cross-Site Scripting via the ‘display_id’ parameter from the Sigmative API in various versions due to insufficient output escaping. This makes it possible for attackers who can compromise the Sigmative API server to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N

Attack vector

Network

Complexity

High

Privileges

None

User interaction

None

Confidentiality

Low

Integrity

Low

Availability

None

Scope

Changed

Exploitation

Is it being used?

Exploit prediction (EPSS)0.4% · higher than 37% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

EP

Element Pack Addons for Elementor – Elementor Widgets, Elementor Templates, Elementor Addons · bdthemes

through 8.7.14 · source: vendor

LC

Live Copy Paste for Elementor – Cross Domain Copy Paste & Page Duplicator · bdthemes

through 1.5.6 · source: vendor

PG

Pixel Gallery Addons for Elementor · bdthemes

through 2.1.14 · source: vendor

PS

Prime Slider – Hero Slider, Carousel, WooCommerce & Post Slider Elementor Addons · bdthemes

through 4.4.5 · source: vendor

SA

Smart Admin Assistant · bdthemes

through 2.2.0 · source: vendor

UP

Ultimate Post Kit – Elementor Post Grid, Post Carousel, Post Slider & Blog Layout Widgets · bdthemes

through 4.2.0 · source: vendor

US

Ultimate Store Kit – Store Builder Addons for Elementor, WooCommerce Store Builder, EDD Store Builder · bdthemes

through 3.0.7 · source: vendor