Read the docs

AivahThemes

Records9All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical2CVSS 9.0–10.0
CVSS high7CVSS 7.0–8.9

Exploited now

AivahThemes records in CISA KEV

No AivahThemes vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Business Hours Pro 1 record MEDIUM

Records

9 records

TI-2026-79734 CVE-2026-112848 · GHSA-f5gh-pc33-83rx

PHP object injection in WordPress Hostme v2 theme

Priority MEDIUM 49

Deserialization of Untrusted Data vulnerability in AivahThemes Hostme v2 hostmev2 allows Object Injection.This issue affects Hostme v2: from n/a through 7.0.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00313 Published 2026-10-23 No fix listed CWE-502
TI-2021-06532 CVE-2021-24240 · GHSA-mwhf-wq2w-263x

Business Hours Pro <= 5.5.0 - Unauthenticated Arbitrary File Upload to RCE

Priority MEDIUM 48

The Business Hours Pro WordPress plugin through 5.5.0 allows a remote attacker to upload arbitrary files using its manual update functionality, leading to an unauthenticated remote code execution vulnerability.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.03037 Published 2021-04-22 No fix listed CWE-434
TI-2025-42359 CVE-2025-68901 · GHSA-3fmc-7wj3-j5v5

WordPress Anona theme <= 8.0 - Arbitrary File Deletion vulnerability

Priority MEDIUM 44

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in AivahThemes Anona anona allows Path Traversal.This issue affects Anona: from n/a through <= 8.0.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.00508 Published 2026-01-22 No fix listed CWE-22
TI-2025-42361 CVE-2025-68903 · GHSA-28gq-jr92-xw88

WordPress Anona theme <= 8.0 - PHP Object Injection vulnerability

Priority MEDIUM 41

Deserialization of Untrusted Data vulnerability in AivahThemes Anona anona allows Object Injection.This issue affects Anona: from n/a through <= 8.0.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00483 Published 2026-01-22 No fix listed CWE-502
TI-2025-42365 CVE-2025-68907 · GHSA-q9f5-85hh-g48c

WordPress Hostme v2 theme <= 7.0 - Arbitrary File Deletion vulnerability

Priority LOW 39

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in AivahThemes Hostme v2 hostmev2 allows Path Traversal.This issue affects Hostme v2: from n/a through <= 7.0.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00441 Published 2026-01-22 No fix listed CWE-22
TI-2025-42360 CVE-2025-68902 · GHSA-g7gq-qmh4-jhww

WordPress Anona theme <= 8.0 - Arbitrary File Download vulnerability

Priority LOW 39

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in AivahThemes Anona anona allows Path Traversal.This issue affects Anona: from n/a through <= 8.0.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00496 Published 2026-01-22 No fix listed CWE-22
TI-2026-79735 CVE-2026-112849 · GHSA-hjrr-8v6p-wh9j

Cross-site scripting in AivahThemes Hostme v2 WordPress theme

Priority LOW 30

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AivahThemes Hostme v2 hostmev2 allows DOM-Based XSS.This issue affects Hostme v2: from n/a through 7.0.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.0019 Published 2026-10-23 No fix listed CWE-79
Open these records in search →