Salevo
Monthly
Unauthenticated remote attackers can supply their own values for web parameters that the VillaTheme Salevo (woo-boost-sales) WordPress plugin treats as immutable, letting them tamper with the data the plugin accepts and acts on in versions up through 1.3.0. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, base score 5.3) confirms the request path needs no authentication, no user interaction, and no non-default configuration, but the impact is capped at a partial integrity loss with no confidentiality or availability effect. No public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS score was supplied, so this is a moderate-priority hardening item rather than an emergency patch, with real exposure confined to sites that actually run this specific plugin.
Unauthenticated remote attackers can supply their own values for web parameters that the VillaTheme Salevo (woo-boost-sales) WordPress plugin treats as immutable, letting them tamper with the data the plugin accepts and acts on in versions up through 1.3.0. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, base score 5.3) confirms the request path needs no authentication, no user interaction, and no non-default configuration, but the impact is capped at a partial integrity loss with no confidentiality or availability effect. No public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS score was supplied, so this is a moderate-priority hardening item rather than an emergency patch, with real exposure confined to sites that actually run this specific plugin.