EUVD-2026-108955
GHSA-hjrr-8v6p-wh9j
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious URL with XSS payload
-
DeliveryLure victim to click link
-
ExploitPayload reaches vulnerable DOM sink
-
ExecutionScript executes in victim browser session
-
ImpactHijack session or perform actions as user
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a victim to interact with attacker-supplied content - specifically visiting or clicking a crafted URL/input that the Hostme v2 theme's client-side JavaScript renders into the DOM without proper neutralization (DOM-based XSS). This user-interaction requirement (UI:R) is the primary limiting factor: the attack cannot succeed purely server-side or without a targeted victim action. No attacker authentication is required (PR:N). The exact vulnerable parameter or DOM sink is not described in the available sources. Affected deployments are WordPress sites running the Hostme v2 theme at versions up to and including 7.0. |
| Impact | This is a DOM-based Cross-Site Scripting flaw (CWE-79) in the AivahThemes Hostme v2 WordPress theme, scored CVSS 7.1 with vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. The vector indicates remote, network-based, low-complexity exploitation requiring no attacker privileges (PR:N) but mandatory victim interaction (UI:R), with a changed scope (S:C) reflecting that injected script executes in the victim's browser context rather than the vulnerable component, and only low confidentiality/integrity/availability impact. The vuln.today decision label is 'this_week' rather than act_now/emergency, consistent with a moderate-severity client-side bug. No CISA KEV listing is present, no EPSS probability is supplied in the input, and no working exploit code is referenced - the only reference is a Patchstack advisory entry, not a PoC. In short, the signals are internally consistent: a genuine but not emergency-grade issue. The required user interaction and the limited, scope-changed impact (session/browser-context compromise rather than server takeover) place this below critical server-side flaws. Missing data worth noting: EPSS is absent, so widespread automated exploitation likelihood cannot be quantified, and no fixed version is stated in the provided data. |
| Exploit ScenarioDerived | An attacker crafts a malicious URL or page input that, when processed by the Hostme v2 theme's client-side code, injects attacker-controlled script into the DOM of a victim's browser. A logged-in site visitor or administrator who clicks the crafted link (UI:R) triggers execution of the script in their session context. No public exploit code is identified at time of analysis; only a Patchstack advisory reference exists. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 23, 2026
DOM-based cross-site scripting in the AivahThemes Hostme v2 WordPress theme (versions through 7.0) allows remote attackers to execute script in a victim's browser session on an affected site. The flaw is rated CVSS 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L): no attacker authentication is required, but exploitation depends on a targeted victim visiting or clicking attacker-supplied content that the theme's client-side JavaScript renders into the DOM without neutralization, and the scope change means injected code can act beyond the vulnerable component. The exact vulnerable parameter and DOM sink are not described in the available sources; no public exploit code was identified at time of analysis and there is no CISA KEV confirmation, and the advisory reference does not state a fixed version.
RemediationAI
The supplied intelligence does not state a fixed version, so the first step is to confirm patch status against the vendor/Patchstack advisory (https://patchstack.com/database/wordpress/theme/hostmev2/vulnerability/wordpress-hostme-v2-theme-7-0-cross-site-scripting-xss-vulnerability?_s_id=cve) and, if a patched release above 7.0 is published, upgrade the theme to that exact version. Where no fix is confirmed, the most complete exposure reduction is to deactivate and remove the Hostme v2 theme from the site; the trade-off is loss of the site's current design and any theme-dependent templates or customizations, so a temporary alternative theme plus a content/design rollback plan is needed. Because this is DOM-based XSS with the rendering logic executing in the browser, server-side filtering and conventional network web-application-firewall signatures provide limited coverage, since the payload may never reach the server in a form those controls inspect; any client-side or Content-Security-Policy restriction should be treated as a partial compensating control with the caveat that tight CSP policies can break legitimate theme and third-party scripts. Restricting who can craft and distribute links to the site (for example, limiting untrusted user-generated content that links into the theme) reduces delivery paths but does not remove the underlying defect.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The issue is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically the DOM-based variant, in a WordPress theme distributed by AivahThemes. In DOM-based XSS the vulnerability lives entirely in client-side JavaScript: a browser-side source (such as the URL fragment, query string, or other attacker-influenced client data) is passed to a DOM sink without sanitization, so the malicious payload is never necessarily transmitted to the PHP/MySQL backend and may not appear in server logs or be caught by server-side input filtering. The CVSS scope-change metric (S:C) reflects that the injected script can affect resources beyond the vulnerable theme component, such as other content or session context on the same origin. The CPE cpe:2.3:a:aivahthemes:hostme_v2:*:*:*:*:*:*:*:* identifies Hostme v2 as the affected product with no version boundaries encoded, matching the description's range of n/a through 7.0; the specific source, sink, and vulnerable parameter are not described in the available sources, so the precise trigger path is unverified.
Know when Hostme V2 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Remote, unauthenticated delivery (AV:N/PR:N) but victim must click crafted content (UI:R); injected script runs in the browser context (S:C) with limited client-side impact (C/I/A:L).
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AivahThemes Hostme v2 hostmev2 allows DOM-Based XSS.This issue affects Hostme v2: from n/a through 7.0.
Executive ViewAI
The Hostme v2 WordPress theme (versions through 7.0) contains a high-severity DOM-based cross-site scripting flaw that allows an attacker to execute malicious scripts in a site visitor's browser session, potentially compromising user interactions and data integrity on affected websites. Leadership should care because this can lead to session hijacking, defacement, or theft of user information, damaging customer trust and brand reputation even without direct server compromise.
No vendor-released patch identified at time of analysis. Interim mitigations include: deploying a WAF with virtual patching for XSS attempts, restricting the theme's use to low-risk sites, conducting regular security awareness training for users to avoid clicking suspicious links, and performing periodic vulnerability scans to detect exploitation attempts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Exploit-DB