AivahThemes vulnerabilities and threats

8 threats

Severity	CVSS	Signals	Threat	Source	Published
Critical	9.8	EPSS 0.3%	CVE-2026-112848Hostme v2 (WordPress plugin) · Deserialization of Untrusted Data Critical9.8EPSS 0.3%2026-10-23CVE Database V5CVE-2026-112848 CVE-2026-112848 is a critical deserialization of untrusted data vulnerability in AivahThemes Hostme v2. This flaw allows object injection, potentially leading to full compromise of confidentiality, integrity, and availability. It affects Hostme v2 versions from initial releases up to and including 7.0. The vulnerability has a CVSS score of 9.8, indicating high severity with network attack vector, no privileges required, and no user interaction needed. EPSS 0.3%Vulnerability AivahThemes	CVE Database V5	2026-10-23
High	7.1	EPSS 0.2%	CVE-2026-112849Hostme v2 (WordPress plugin) · Cross-site Scripting High7.1EPSS 0.2%2026-10-23CVE Database V5CVE-2026-112849 CVE-2026-112849 is a high-severity DOM-based Cross-site Scripting (XSS) vulnerability in AivahThemes Hostme v2. The flaw arises from improper neutralization of input during web page generation, affecting versions up to and including 7.0. This vulnerability allows an attacker to inject malicious scripts that can execute in the context of the victim's browser, potentially leading to information disclosure, integrity loss, and availability impact. EPSS 0.2%Vulnerability AivahThemes	CVE Database V5	2026-10-23
High	8.6	EPSS 0.5%	CVE-2025-69139Car Zone (WordPress plugin) · Path Traversal High8.6EPSS 0.5%2026-06-16CVE Database V5CVE-2025-69139 Unauthenticated Arbitrary File Deletion in Car Zone <= 3.7 versions. EPSS 0.5%Vulnerability AivahThemes CWE-22	CVE Database V5	2026-06-16
High	8.8	EPSS 0.5%	CVE-2026-27338Car Zone (WordPress plugin) · Deserialization of Untrusted Data High8.8EPSS 0.5%2026-03-05CVE Database V5CVE-2026-27338 Deserialization of Untrusted Data vulnerability in AivahThemes Car Zone carzone allows Object Injection.This issue affects Car Zone: from n/a through <= 3.7. EPSS 0.5%Vulnerability AivahThemes	CVE Database V5	2026-03-05
High	7.5	EPSS 0.4%	CVE-2025-68907Hostme v2 (WordPress plugin) · Path Traversal High7.5EPSS 0.4%2026-01-22CVE Database V5CVE-2025-68907 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in AivahThemes Hostme v2 hostmev2 allows Path Traversal.This issue affects Hostme v2: from n/a through <= 7.0. EPSS 0.4%Vulnerability AivahThemes	CVE Database V5	2026-01-22
High	8.8	EPSS 0.5%	CVE-2025-68903Anona (WordPress plugin) · Deserialization of Untrusted Data High8.8EPSS 0.5%2026-01-22CVE Database V5CVE-2025-68903 Deserialization of Untrusted Data vulnerability in AivahThemes Anona anona allows Object Injection.This issue affects Anona: from n/a through <= 8.0. EPSS 0.5%Vulnerability AivahThemes	CVE Database V5	2026-01-22
High	7.5	EPSS 0.5%	CVE-2025-68902Anona (WordPress plugin) · Path Traversal High7.5EPSS 0.5%2026-01-22CVE Database V5CVE-2025-68902 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in AivahThemes Anona anona allows Path Traversal.This issue affects Anona: from n/a through <= 8.0. EPSS 0.5%Vulnerability AivahThemes	CVE Database V5	2026-01-22
High	8.6	EPSS 0.5%	CVE-2025-68901Anona (WordPress plugin) · Path Traversal High8.6EPSS 0.5%2026-01-22CVE Database V5CVE-2025-68901 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in AivahThemes Anona anona allows Path Traversal.This issue affects Anona: from n/a through <= 8.0. EPSS 0.5%Vulnerability AivahThemes	CVE Database V5	2026-01-22

Page 1 of 1