Live › vulnerability › CVE-2026-112849
Go to dashboardAivahThemes Hostme v2, a WordPress-style hosting theme, has a DOM-based cross-site scripting flaw in versions through 7.0. An attacker can get script to run in a visitor's browser through crafted input handled by client-side page code.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the AivahThemes Hostme v2 theme at version 7.0 or earlier are exposed. The sources do not say which pages or inputs trigger the flaw, so any site using this theme should be checked. Sites that do not use Hostme v2 can skip it.
No product ranges from the sources yet.
7.0, as the sources do not name a fixed releaseEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AivahThemes Hostme v2 hostmev2 allows DOM-Based XSS.This issue affects Hostme v2: from n/a through 7.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-112849")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.