AivahThemes Hostme: DOM-based cross-site scripting (CVE-2026-112849)
AivahThemes Hostme version 7.0 and earlier contains a DOM-based cross-site scripting vulnerability resulting from improper input sanitization during web page generation.
CVE search metadata
CVE search record: CVE-2026-112849. Severity: high. CVSS: 7.1. KEV: no. Product: Hostme v2 (n/a through 7.0). Brief: AivahThemes Hostme: DOM-based cross-site scripting (CVE-2026-112849). Brief link: https://feed.craftedsignal.io/briefs/2026-10-aivahthemes-hostme-xss/
CVE search record: CVE-2026-112848. Severity: critical. CVSS: 9.8. KEV: no. Product: Hostme v2 (n/a through 7.0). Brief: AivahThemes Hostme: DOM-based cross-site scripting (CVE-2026-112849). Brief link: https://feed.craftedsignal.io/briefs/2026-10-aivahthemes-hostme-xss/
Triage facts
Revision 1- Applicability
- Hostme v2 (n/a through 7.0)
- Evidence
- Unknown
- Severity
- Critical
- Action
- Elevated
- Sources
- 2 public sources
- Freshness
- Revision 1Oct 23, 13:41 UTC
- Vulnerabilities
- 2 CVEs
- Source quality
- A1Likely
What's new
- 1. severity → critical; added CVE-2026-112848 Oct 23, 15:07 via nvd
A vulnerability identified as CVE-2026-112849 exists in AivahThemes Hostme v2 (versions up to 7.0). The software fails to properly neutralize user-controlled input, leading to DOM-based Cross-Site Scripting (XSS). This vulnerability allows an attacker to inject and execute arbitrary scripts within the context of a victim's browser session when they interact with a crafted page. No patch availability is currently noted in the source.
Impact
Successful exploitation allows for the execution of malicious scripts in the victim's browser, potentially leading to session hijacking, unauthorized actions performed on behalf of the user, or redirection to malicious sites.
Recommendation
- Inventory all instances of AivahThemes Hostme v2 within the environment.
- Apply strict input validation and output encoding for all user-controllable data on web-facing applications.
- Monitor web traffic and user sessions for suspicious script execution or unexpected redirections emanating from the Hostme application.
- Implement a strong Content Security Policy (CSP) to mitigate the impact of potential XSS attacks.
Immediate actions
Inventory all servers running AivahThemes Hostme v2
Threat Hunt
Search web application logs for unusual URL parameters containing script tags or JavaScript event handlers
Data: Web server access logs
Mitigations
Deploy Content Security Policy (CSP) to restrict allowed script sources
CVE-2026-112849