Hostiko Vulnerabilities

The Hostiko theme for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to 94.3.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVSS:

7.2

Affected:

up to 94.3.6

Fixed in:

94.3.6

Disclosed:

Jan 20, 2026

CVE-2025-67949 on NVD →

The Hostiko - Hosting WordPress & WHMCS Theme theme for WordPress is vulnerable to Local File Inclusion in all versions up to 30.1 (exclusive). This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be us...

CVSS:

8.1

Affected:

up to 30.1

Fixed in:

30.1

Disclosed:

Feb 18, 2025

CVE-2025-27015 on NVD →

The Hostiko - Hosting WordPress & WHMCS Theme theme for WordPress is vulnerable to Reflected Cross-Site Scripting in all versions up to 30.1 (exclusive) due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute...

CVSS:

6.1

Affected:

up to 30.1

Fixed in:

30.1

Disclosed:

Feb 18, 2025

CVE-2025-27014 on NVD →