{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/aivahthemes/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:aivahthemes:hostme:*:*:*:*:*:*:*:*","cpe:2.3:a:aivahthemes:hostme_v2:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.1,"id":"CVE-2026-112849"},{"cvss":9.8,"id":"CVE-2026-112848"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Hostme v2 (n/a through 7.0)"],"_cs_severities":["critical"],"_cs_tags":["web-application","xss","vulnerability"],"_cs_type":"advisory","_cs_vendors":["AivahThemes"],"content_html":"\u003cp\u003eA vulnerability identified as CVE-2026-112849 exists in AivahThemes Hostme v2 (versions up to 7.0). The software fails to properly neutralize user-controlled input, leading to DOM-based Cross-Site Scripting (XSS). This vulnerability allows an attacker to inject and execute arbitrary scripts within the context of a victim's browser session when they interact with a crafted page. No patch availability is currently noted in the source.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for the execution of malicious scripts in the victim's browser, potentially leading to session hijacking, unauthorized actions performed on behalf of the user, or redirection to malicious sites.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eInventory all instances of AivahThemes Hostme v2 within the environment.\u003c/li\u003e\n\u003cli\u003eApply strict input validation and output encoding for all user-controllable data on web-facing applications.\u003c/li\u003e\n\u003cli\u003eMonitor web traffic and user sessions for suspicious script execution or unexpected redirections emanating from the Hostme application.\u003c/li\u003e\n\u003cli\u003eImplement a strong Content Security Policy (CSP) to mitigate the impact of potential XSS attacks.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-23T15:07:25Z","date_published":"2026-10-23T13:41:06Z","id":"https://feed.craftedsignal.io/briefs/2026-10-aivahthemes-hostme-xss/","summary":"AivahThemes Hostme version 7.0 and earlier contains a DOM-based cross-site scripting vulnerability resulting from improper input sanitization during web page generation.","title":"AivahThemes Hostme: DOM-based cross-site scripting (CVE-2026-112849)","url":"https://feed.craftedsignal.io/briefs/2026-10-aivahthemes-hostme-xss/"}],"language":"en","title":"CraftedSignal Threat Feed - AivahThemes","version":"https://jsonfeed.org/version/1.1"}