CVE-2026-112849: WordPress Hostme v2 theme <= 7.0 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AivahThemes Hostme v2 hostmev2 allows DOM-Based XSS.This issue affects Hostme v2: from n/a through 7.0.
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The vulnerability is remotely reachable and requires no attacker privileges, but it requires user interaction. The affected behavior is DOM-based XSS, meaning exploitation occurs in the victim's browser when it processes attacker-controlled input.
Which Hostme v2 versions are affected?
Hostme v2 versions through 7.0 are affected. The available data does not identify an unaffected fixed version.
What impact could successful exploitation have?
Successful exploitation can affect confidentiality, integrity, and availability at a low level. Because scope is changed, the impact may extend beyond the vulnerable theme's immediate security context.