Hostme v2: DOM-based cross-site scripting
An unauthenticated attacker can craft script-bearing input that reaches an unsafe browser-side DOM operation. A victim must interact with the crafted request or page for script to execute in the site origin; the victim role is not disclosed. The endpoint, action and parameter are not disclosed. The CNA vector records limited confidentiality impact, limited integrity impact, limited availability impact. Affected versions: at most 7.0.
- Component
- Hostme v2
- Plugin slug
hostmev2- Affected
- <= 7.0
- Safe version
- See mitigation notes
- Published
- Oct 23, 2026
This CVE was published Oct 23, 2026 and is one of 3 known issues for this theme.
Update, patch or deactivate.
Official author notes reviewed on 2026-10-24 through 8.0.2 do not establish a fixed version for this CVE. 8.x slider/sidebar/JavaScript/options-panel changes do not identify DOM XSS. This archive's uncertainty does not establish that the vendor has not fixed the issue. Restrict or disable the affected feature where warranted and consult the author. Official notes: https://themeforest.net/item/hostme-v2-responsive-wordpress-theme/5275274. Validate accepted input and use context-appropriate escaping or safe DOM text operations instead of interpreting untrusted input as markup.
No confirmed safe version is listed. Consider a vendor-supported patch or temporarily restricting the affected functionality while you assess the risk.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AivahThemes Hostme v2 hostmev2 allows DOM-Based XSS.This issue affects Hostme v2: from n/a through 7.0.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L