Hostme V2
Monthly
PHP object injection in the AivahThemes Hostme v2 WordPress theme (all versions through 7.0) allows unauthenticated remote attackers to pass serialized data into a PHP unserialize() sink, which can lead to arbitrary object instantiation and, where a usable gadget chain exists, code execution or full site compromise. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H, 9.8) confirms no authentication or user interaction is required, so any site running the theme with the affected code path active is exposed. A public PoC reference exists in the Patchstack advisory; it is not verified as working exploit code, and no CISA KEV entry indicates confirmed active exploitation. The precise request parameter or endpoint that reaches the sink is not described in the available sources, and no fixed version is listed in the evidence.
DOM-based cross-site scripting in the AivahThemes Hostme v2 WordPress theme (versions through 7.0) allows remote attackers to execute script in a victim's browser session on an affected site. The flaw is rated CVSS 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L): no attacker authentication is required, but exploitation depends on a targeted victim visiting or clicking attacker-supplied content that the theme's client-side JavaScript renders into the DOM without neutralization, and the scope change means injected code can act beyond the vulnerable component. The exact vulnerable parameter and DOM sink are not described in the available sources; no public exploit code was identified at time of analysis and there is no CISA KEV confirmation, and the advisory reference does not state a fixed version.
PHP object injection in the AivahThemes Hostme v2 WordPress theme (all versions through 7.0) allows unauthenticated remote attackers to pass serialized data into a PHP unserialize() sink, which can lead to arbitrary object instantiation and, where a usable gadget chain exists, code execution or full site compromise. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H, 9.8) confirms no authentication or user interaction is required, so any site running the theme with the affected code path active is exposed. A public PoC reference exists in the Patchstack advisory; it is not verified as working exploit code, and no CISA KEV entry indicates confirmed active exploitation. The precise request parameter or endpoint that reaches the sink is not described in the available sources, and no fixed version is listed in the evidence.
DOM-based cross-site scripting in the AivahThemes Hostme v2 WordPress theme (versions through 7.0) allows remote attackers to execute script in a victim's browser session on an affected site. The flaw is rated CVSS 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L): no attacker authentication is required, but exploitation depends on a targeted victim visiting or clicking attacker-supplied content that the theme's client-side JavaScript renders into the DOM without neutralization, and the scope change means injected code can act beyond the vulnerable component. The exact vulnerable parameter and DOM sink are not described in the available sources; no public exploit code was identified at time of analysis and there is no CISA KEV confirmation, and the advisory reference does not state a fixed version.