CVE-2026-112849

HighCVSS 7.1

Published: 23/10/2026(UTC)Updated: 23/10/2026(UTC)Translated: 23/10/2026(UTC)NVD NIST

Summary

The Hostme v2 WordPress theme (AivahThemes) in versions up to 7.0 contains a DOM-Based Cross-site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation. An attacker can trick a user into interacting with a crafted page, leading to execution of malicious script in the victim's browser.

Risk Assessment

Potential execution of arbitrary script in the user's browser context, which may lead to session or data theft.

Recommendation

Update the Hostme v2 theme to a version later than 7.0, which contains the fix for this issue.

Other vulnerabilities in Hostme v2

CVE-2026-112848Critical
A deserialization of untrusted data vulnerability in the AivahThemes Hostme v2 WordPress theme allows object injection. The issue affects Hostme v2 from n/a through version 7.0.

Original NVD description (English source)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AivahThemes Hostme v2 hostmev2 allows DOM-Based XSS.This issue affects Hostme v2: from n/a through 7.0.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS