Cpe:2.3:a:aivahthemes:hostme_v2:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3aaivahthemeshostme_v2/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 23 Oct 2026 13:41:06 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgAivahThemes Hostme: DOM-based cross-site scripting (CVE-2026-112849)https://feed.craftedsignal.io/briefs/2026-10-aivahthemes-hostme-xss/Fri, 23 Oct 2026 13:41:06 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-aivahthemes-hostme-xss/AivahThemes Hostme version 7.0 and earlier contains a DOM-based cross-site scripting vulnerability resulting from improper input sanitization during web page generation.A vulnerability identified as CVE-2026-112849 exists in AivahThemes Hostme v2 (versions up to 7.0). The software fails to properly neutralize user-controlled input, leading to DOM-based Cross-Site Scripting (XSS). This vulnerability allows an attacker to inject and execute arbitrary scripts within the context of a victim's browser session when they interact with a crafted page. No patch availability is currently noted in the source.

Impact

Successful exploitation allows for the execution of malicious scripts in the victim's browser, potentially leading to session hijacking, unauthorized actions performed on behalf of the user, or redirection to malicious sites.

Recommendation

  • Inventory all instances of AivahThemes Hostme v2 within the environment.
  • Apply strict input validation and output encoding for all user-controllable data on web-facing applications.
  • Monitor web traffic and user sessions for suspicious script execution or unexpected redirections emanating from the Hostme application.
  • Implement a strong Content Security Policy (CSP) to mitigate the impact of potential XSS attacks.
]]>criticaladvisoryweb-applicationxssvulnerability