CVE-2026-112849: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in AivahThemes Hostme v2

CVE-2026-112849 describes a DOM-Based Cross-site Scripting vulnerability in AivahThemes Hostme v2, affecting versions from 0 through 7.0. The flaw is due to improper neutralization of input during web page generation, which allows attackers to inject and execute arbitrary scripts in the victim's browser. The CVSS 3.1 score is 7.1, indicating a high severity with network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and impacts on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the victim's browser session, potentially leading to partial disclosure of sensitive information, modification of data, and disruption of service availability. The CVSS vector indicates that the attack can be performed remotely without privileges but requires user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. In the absence of an official fix, users should consider applying input validation and output encoding controls where possible and restrict user input that can be reflected in web pages. Monitor vendor channels for updates and patches.