CVE-2026-103081: WordPress Salevo plugin <= 1.3.0 - Content Injection vulnerability
Improper Control of Generation of Code ('Code Injection') vulnerability in VillaTheme Salevo woo-boost-sales allows Code Injection.This issue affects Salevo: from n/a through 1.3.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Salevo pluginto a version that resolves this vulnerability.Fixed in 1.3.1
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The CVSS vector indicates network-based exploitation with low attack complexity. No privileges or user interaction are required.
What is the likely security impact?
The issue is rated high severity with a 7.5 CVSS score. The vector indicates high confidentiality impact, with no integrity or availability impact identified.
Which deployments should be prioritized for triage?
Deployments using the VillaTheme Salevo plugin at version 1.3.0 or earlier should be prioritized. The affected version range is listed as through 1.3.0.