{"id":"CVE-2026-112849","kind":"vulnerability","aliases":["CVE-2026-112849"],"related":[],"title":"Hostme v2 theme: DOM-based XSS lets attackers run scripts in pages","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AivahThemes Hostme v2 hostmev2 allows DOM-Based XSS.This issue affects Hostme v2: from n/a through 7.0.","summary":"AivahThemes Hostme v2, a WordPress-style hosting theme, has a DOM-based cross-site scripting flaw in versions through 7.0. An attacker can get script to run in a visitor's browser through crafted input handled by client-side page code.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["hostme-v2","other","themes","wordpress"],"not_affected_if":["theme-not-installed"],"how_to_check":"- Check the installed Hostme v2 theme version in the theme's style.css header or the WordPress admin under Appearance > Themes\n- unknown for other checks, the sources do not say which input or page triggers it","fix":"- Update Hostme v2 to a version later than `7.0`, as the sources do not name a fixed release\n- unknown for a specific patched version, check the vendor or NVD entry","status":"open","published_at":"2026-10-23T13:17:06+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","triaged_at":"2026-10-25T03:31:17+00:00","updated_at":"2026-10-25T03:31:17+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-10-25T03:31:17Z","model":"claude-haiku-5-5","output":{"fix":"- Update Hostme v2 to a version later than `7.0`, as the sources do not name a fixed release\n- unknown for a specific patched version, check the vendor or NVD entry","reach":"internet","title":"Hostme v2 theme: DOM-based XSS lets attackers run scripts in pages","impact":"medium","summary":"AivahThemes Hostme v2, a WordPress-style hosting theme, has a DOM-based cross-site scripting flaw in versions through 7.0. An attacker can get script to run in a visitor's browser through crafted input handled by client-side page code.","category":"other","nicknames":[],"who_cares":["wordpress","themes","hostme-v2"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Attacker script runs in visitors' browsers, stealing sessions or actions","analyst_note":"Find the vendor advisory or patched version for Hostme v2 and the vulnerable page or parameter; NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-112849 gives no fix or trigger details.","how_to_check":"- Check the installed Hostme v2 theme version in the theme's style.css header or the WordPress admin under Appearance > Themes\n- unknown for other checks, the sources do not say which input or page triggers it","needs_analyst":true,"not_affected_if":["theme-not-installed"],"who_is_affected":"Sites running the AivahThemes Hostme v2 theme at version 7.0 or earlier are exposed. The sources do not say which pages or inputs trigger the flaw, so any site using this theme should be checked. Sites that do not use Hostme v2 can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000639,"input_tokens":3313,"output_tokens":615,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-112849':16A,19A '-2026':15A,18A '7.0':48B,101C 'affect':95C 'aivahthem':26B,85C 'allow':89C 'attack':9A,50B 'base':6A,39B,92C 'browser':60B 'client':67B 'client-sid':66B 'code':70B 'craft':62B 'cross':41B,80C 'cross-sit':40B,79C 'cve':14A,17A 'dom':5A,38B,91C 'dom-bas':4A,37B,90C 'flaw':44B 'generat':78C 'get':52B 'handl':64B 'host':33B 'hostm':1A,21B,27B,86C,96C 'hostme-v2':20B 'hostmev2':88C 'improp':71C 'input':63B,74C 'issu':94C 'let':8A 'n/a':99C 'neutral':72C 'page':13A,69B,77C 'run':10A,55B 'script':11A,43B,53B,82C 'side':68B 'site':42B,81C 'style':32B 'theme':3A,24B,34B 'v2':2A,22B,28B,87C,97C 'version':46B 'visitor':58B 'vulner':83C 'web':76C 'wordpress':25B,31B 'wordpress-styl':30B 'xss':7A 'xss.this':93C","nicknames":[],"mitigations":[],"who_affected":"Sites running the AivahThemes Hostme v2 theme at version 7.0 or earlier are exposed. The sources do not say which pages or inputs trigger the flaw, so any site using this theme should be checked. Sites that do not use Hostme v2 can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T13:17:06+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112849","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112849","severity":null,"published_at":"2026-10-23T13:17:06+00:00","modified_at":"2026-10-23T16:06:31+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}