CVE-2026-112848

CriticalCVSS 9.8

Published: 23/10/2026(UTC)Updated: 24/10/2026(UTC)Translated: 23/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.31%

24th percentile - higher than 24% of all known CVEs

Summary

A deserialization of untrusted data vulnerability in the AivahThemes Hostme v2 WordPress theme allows object injection. The issue affects Hostme v2 from n/a through version 7.0.

Risk Assessment

Object injection can lead to remote code execution or serious compromise of the WordPress site. Organizations using this theme are exposed to potential full application takeover.

Recommendation

Update the Hostme v2 theme to a version later than 7.0 or remove it if unused. Until patched, restrict access to deserialization functionality and monitor for unusual activity.

Other vulnerabilities in Hostme v2

CVE-2026-112849High
The Hostme v2 WordPress theme (AivahThemes) in versions up to 7.0 contains a DOM-Based Cross-site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation. An attacker can trick a user into interacting with a crafted page, leading to execution of malicious script in the victim's browser.

Original NVD description (English source)

Deserialization of Untrusted Data vulnerability in AivahThemes Hostme v2 hostmev2 allows Object Injection.This issue affects Hostme v2: from n/a through 7.0.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS