The Salevo plugin is vulnerable to improper control of code generation, which allows an attacker to inject and execute arbitrary code within the plugin’s context. This flaw falls under CWE‑94 and can lead to unauthorized code execution, compromising the integrity and confidentiality of the WordPress site.

All released versions of VillaTheme’s Salevo WordPress plugin up to and including 1.3.0 are affected. The vulnerability applies to 1.3.0 and any older releases for which no specific lower bound was disclosed.

The CVSS score of 7.5 reflects a high risk and the EPSS score of < 1% indicates a low likelihood of exploitation currently. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is inferred from the supplied description: attackers could deliver malicious payloads through the plugin’s input mechanisms, possibly via the WordPress backend or a publicly exposed API. Successful exploitation could result in unauthorized code execution, site defacement, or data disclosure depending on the attacker’s objectives.