The Hostme v2 theme for WordPress contains a DOM‑Based Cross‑Site Scripting flaw that permits an attacker to inject arbitrary JavaScript into pages rendered by the theme. The flaw is caused by improper neutralization of user‑controlled input during page generation. If exploited, malicious scripts could execute in the victim’s browser while visiting affected pages. Based on the nature of XSS, an attacker could potentially steal information, hijack sessions, or deface the site, though these specific outcomes are inferred from standard XSS effects and are not explicitly stated in the CVE description.

This vulnerability affects the AivahThemes Hostme v2 WordPress theme in all releases from the initial version up to and including 7.0. Versions 7.1 and later include a fix and are not impacted.

The CVSS score of 7.1 indicates moderate‑to‑high severity. Because the flaw is client‑side, exploitation requires a victim to load a crafted page; no privileged server‑side access or authentication is needed. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no widespread exploitation is known. However, the typical attack vector is straightforward for an attacker who can lure a user to a malicious URL.