CVE-2026-112849: WordPress Hostme v2 theme <= 7.0 - Cross Site Scripting (XSS) vulnerability

Deferred

Published 23-10-2026Last modified 23-10-2026

Vulnerability summary

CVE-2026-112849 is a high (CVSS 7.1) Cross-site Scripting vulnerability in aivahthemes hostme v2.

Overall risk

28/100

0100

Medium · default modelHow is this calculated?

CVSS score

7.1/10

010

High · v3.1 (CVE.org)

EPSS scoreNot scoredRisk metrics not yet published.

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Timeline

23-10-2026
PublishedVulnerability first disclosed.
23-10-2026
Last modifiedVulnerability information updated.

Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AivahThemes Hostme v2 hostmev2 allows DOM-Based XSS.This issue affects Hostme v2: from n/a through 7.0.

CVSS metrics

2 scores · 2 sources · 1 version

v3.17.1

EPSS trend

No EPSS score has been published for this record yet.

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Affected systems

Aivahthemes1 product

hostme v2≤ 7.0

1 vendor · 1 product

References

1 links

patchstack.com/database/…VDB Entry