CVE-2026-103081

HighCVSS 7.5

Published: 14/10/2026(UTC)Updated: 15/10/2026(UTC)Translated: 15/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.32%

23th percentile - higher than 23% of all known CVEs

Summary

Improper Control of Generation of Code ('Code Injection') vulnerability in VillaTheme Salevo woo-boost-sales allows Code Injection. This issue affects Salevo: from n/a through 1.3.0.

Risk Assessment

An attacker can inject and execute arbitrary code in the application context, potentially leading to full site compromise. The risk affects sites with the vulnerable plugin installed.

Recommendation

Upgrade the Salevo plugin to a version later than 1.3.0 that contains the fix. Until then, consider disabling the plugin.

Other vulnerabilities in Salevo

CVE-2026-103080Medium
External Control of Assumed-Immutable Web Parameter vulnerability in VillaTheme Salevo woo-boost-sales allows Input Data Manipulation.This issue affects Salevo: from n/a through 1.3.0.

Original NVD description (English source)

Improper Control of Generation of Code ('Code Injection') vulnerability in VillaTheme Salevo woo-boost-sales allows Code Injection.This issue affects Salevo: from n/a through 1.3.0.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS