CVE-2026-103081

Deferred Deferred - Pending Action

Code Injection in VillaTheme Salevo woo-boost-sales

Publication date: 2026-10-14

Last updated on: 2026-10-15

Assigner: Patchstack

Description

Improper Control of Generation of Code ('Code Injection') vulnerability in VillaTheme Salevo woo-boost-sales allows Code Injection.This issue affects Salevo: from n/a through 1.3.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-103081

EUVD

EUVD-2026-101523

Affected Vendors & Products

Vendor	Product	Version / Range
VillaTheme	Salevo	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-94	The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

Executive Summary

This vulnerability is a code injection flaw in the VillaTheme Salevo woo-boost-sales WordPress plugin. It allows attackers to inject unwanted content like ads, scams, or malware links into web pages without needing authentication.

Detection Guidance

Check if the Salevo plugin version 1.3.0 or below is installed on your WordPress site. Look for unexpected content injections like ads or malicious links on web pages. Use WordPress admin panel to inspect plugin versions or scan files for unauthorized modifications.

Impact Analysis

Attackers could exploit this to inject malicious content into your website, potentially spreading malware to visitors, displaying scams, or harming your site's reputation. It may also lead to unauthorized modifications of site content.

Compliance Impact

This vulnerability could lead to data breaches or unauthorized content changes, violating GDPR (data protection) and HIPAA (health data security) requirements. Non-compliance may result in legal penalties and reputational damage.

Mitigation Strategies

Update the Salevo plugin to version 1.3.1 or later immediately. Apply Patchstack's mitigation rule to block attacks until the update is completed. Remove any unauthorized content or files injected by attackers.

Hi! I’m here to help you understand CVE-2026-103081. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70