Skip to content
OpenAdvisories

Vendor

favethemes

31 known vulnerabilities.

favethemes at a glance

Last 12 months
7
Critical · all time
6
Exploited · all time
0
Public exploit · all time
0
New vulnerabilities per month · last 12 months
0 1 2 December 2025: 1 vulnerability Dec 2025 January 2026: 2 vulnerabilities February 2026: 0 vulnerabilities March 2026: 0 vulnerabilities Mar April 2026: 0 vulnerabilities May 2026: 0 vulnerabilities June 2026: 0 vulnerabilities Jun July 2026: 1 vulnerability August 2026: 0 vulnerabilities September 2026: 0 vulnerabilities Sep October 2026: 1 vulnerability November 2026: 0 vulnerabilities
Show as table
MonthVulnerabilitiesCritical
Nov 202600
Oct 202610
Sep 202600
Aug 202600
Jul 202610
Jun 202600
May 202600
Apr 202600
Mar 202600
Feb 202600
Jan 202620
Dec 202510
Nov 202540
Oct 202530
Sep 202500
Aug 202540
Jul 202520
Jun 202511
May 202500
Apr 202511
Mar 202500
Feb 202500
Jan 202531
Dec 202400

Products

Houzez 14 Houzez Theme - Functionality 5 Houzez Login Register 3 Homey 3 Homey Core 2 Houzez - Real Estate WordPress Theme 2 Homey Login Register 1 MLS On The Fly 1
All Critical High Medium Low Exploited only Public exploit

31 results · Feed

  • High 8.5
    CVE-2026-61996

    WordPress MLS On The Fly plugin <= 1.8.1.5 - SQL Injection vulnerability

    Subscriber SQL Injection in MLS On The Fly <= 1.8.1.5 versions.

    favethemes MLS On The Fly
  • High 8.2
    CVE-2026-57768

    WordPress Houzez Login Register plugin <= 3.3.3 - Privilege Escalation vulnerability

    Incorrect Privilege Assignment vulnerability in favethemes Houzez Login Register houzez-login-register allows Privilege Escalation.This issue affects Houzez Login Register: from n/a through <= 3.3.3.

    favethemes Houzez Login Register
  • Medium 6.5
    CVE-2026-24355

    WordPress Houzez Theme - Functionality plugin <= 4.2.6 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in favethemes Houzez Theme - Functionality houzez-theme-functionality allows Stored XSS.This issue affects Houzez Theme - Functionality: from n/a through <= 4.2…

    favethemes Houzez Theme - Functionality
  • High 7.1
    CVE-2025-67964

    WordPress Homey Core plugin <= 2.4.3 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in favethemes Homey Core homey-core allows Reflected XSS.This issue affects Homey Core: from n/a through <= 2.4.3.

    favethemes Homey Core
  • Medium 5.3
    CVE-2025-67965

    WordPress Homey Core plugin <= 2.4.3 - Broken Access Control vulnerability

    Missing Authorization vulnerability in favethemes Homey Core homey-core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Homey Core: from n/a through <= 2.4.3.

    favethemes Homey Core
  • Medium 6.1
    CVE-2025-9163

    Houzez <= 4.1.6 - Unauthenticated Stored Cross-Site Scripting via SVG File Upload

    The Houzez theme for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 4.1.6 due to insufficient input sanitization and output escaping in the houzez_property_img_upload() and houzez_property_att…

    favethemes Houzez Web / CMS
  • Medium 6.3
    CVE-2025-9191

    Houzez <= 4.1.6 - Authenticated (Subscriber+) PHP Object Injection via Saved Search

    The Houzez theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.1.6 via deserialization of untrusted input in saved-search-item.php. This makes it possible for authenticated attackers, with Subscriber-level access …

    favethemes Houzez Web / CMS
  • High 7.1
    CVE-2025-62057

    WordPress Houzez Theme - Functionality plugin < 4.2.0 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in favethemes Houzez Theme - Functionality houzez-theme-functionality.This issue affects Houzez Theme - Functionality: from n/a through < 4.2.0.

    favethemes Houzez Theme - Functionality
  • High 8.1
    CVE-2025-62053

    WordPress Houzez theme < 4.2.0 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in favethemes Houzez houzez.This issue affects Houzez: from n/a through < 4.2.0.

    favethemes Houzez
  • High 7.5
    CVE-2025-62054

    WordPress Houzez Theme - Functionality plugin <= 4.1.8 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in favethemes Houzez Theme - Functionality houzez-theme-functionality.This issue affects Houzez Theme - Functionality: from n/a through <= 4.…

    favethemes Houzez Theme - Functionality
  • Medium 6.5
    CVE-2025-62058

    WordPress Houzez Theme - Functionality plugin < 4.2.0 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in favethemes Houzez Theme - Functionality houzez-theme-functionality.This issue affects Houzez Theme - Functionality: from n/a through < 4.2.0.

    favethemes Houzez Theme - Functionality
  • Medium 6.5
    CVE-2025-49952

    WordPress Houzez theme <= 4.2.5 - Insecure Direct Object References (IDOR) vulnerability

    Authorization Bypass Through User-Controlled Key vulnerability in favethemes Houzez houzez allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Houzez: from n/a through <= 4.2.5.

    favethemes Houzez
  • High 8.8
    CVE-2025-49407

    WordPress Houzez Theme <= 4.1.1 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in favethemes Houzez allows Reflected XSS. This issue affects Houzez: from n/a through 4.1.1.

    favethemes Houzez
  • Medium 4.3
    CVE-2025-49405

    WordPress Houzez Theme < 4.1.4 - Local File Inclusion Vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Favethemes Houzez allows PHP Local File Inclusion.This issue affects Houzez: from n/a before 4.1.4.

    favethemes Houzez
  • High 8.5
    CVE-2025-49406

    WordPress Houzez Theme <= 4.1.1 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in favethemes Houzez allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Houzez: from n/a through 4.1.1.

    favethemes Houzez
  • High 8.1
    CVE-2025-53198

    WordPress Houzez theme <= 4.0.4 - Local File Inclusion Vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in favethemes Houzez houzez allows PHP Local File Inclusion.This issue affects Houzez: from n/a through <= 4.0.4.

    favethemes Houzez
  • Medium 4.3
    CVE-2025-53997

    WordPress Houzez theme <= 4.0.4 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in favethemes Houzez houzez allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Houzez: from n/a through <= 4.0.4.

    favethemes Houzez
  • High 7.1
    CVE-2025-31037

    WordPress Homey theme <= 2.4.5 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in favethemes Homey homey allows Reflected XSS.This issue affects Homey: from n/a through <= 2.4.5.

    favethemes Homey
  • Critical 9.3
    CVE-2025-52834

    WordPress Homey theme <= 2.4.7 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in favethemes Homey homey allows SQL Injection.This issue affects Homey: from n/a through <= 2.4.7.

    favethemes Homey
  • Critical 9.8
    CVE-2024-51800

    WordPress Homey theme <= 2.4.1 - Privilege Escalation vulnerability

    Incorrect Privilege Assignment vulnerability in Favethemes Homey allows Privilege Escalation.This issue affects Homey: from n/a through 2.4.1.

    favethemes Homey
  • Medium 5.3
    CVE-2025-24747

    WordPress Houzez theme <= 3.4.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in favethemes Houzez houzez.This issue affects Houzez: from n/a through <= 3.4.0.

    favethemes Houzez
  • Medium 4.3
    CVE-2025-24754

    WordPress Houzez theme <= 3.4.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in favethemes Houzez houzez.This issue affects Houzez: from n/a through <= 3.4.0.

    favethemes Houzez
  • Critical 9.8
    CVE-2024-51888

    WordPress Homey Login Register Plugin <= 2.4.0 - Privilege Escalation vulnerability

    Incorrect Privilege Assignment vulnerability in favethemes Homey Login Register homey-login-register allows Privilege Escalation.This issue affects Homey Login Register: from n/a through <= 2.4.0.

    favethemes Homey Login Register
  • High 8.8
    CVE-2024-22303

    WordPress Houzez theme <= 3.2.4 - Privilege Escalation vulnerability

    Incorrect Privilege Assignment vulnerability in favethemes Houzez allows Privilege Escalation.This issue affects Houzez: from n/a through 3.2.4.

    favethemes Houzez
  • High 8.8
    CVE-2024-21743

    WordPress Houzez Login Register plugin <= 3.2.5 - Privilege Escalation vulnerability

    Privilege Escalation vulnerability in favethemes Houzez Login Register houzez-login-register.This issue affects Houzez Login Register: from n/a through 3.2.5.

    favethemes Houzez Login Register
  • High 7.1
    CVE-2024-43244

    WordPress houzez Theme By FaveThemes <= 3.2.4 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in favethemes Houzez allows Reflected XSS.This issue affects Houzez: from n/a through 3.2.4.

    favethemes Houzez
  • High 8.8
    CVE-2024-5793

    Houzez Theme - Functionality <= 3.2.2 - Authenticated (Seller+) SQL Injection

    The Houzez Theme - Functionality plugin for WordPress is vulnerable to SQL Injection via the ‘currency_code’ parameter in all versions up to, and including, 3.2.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation o…

    favethemes Houzez Theme - Functionality Web / CMS
  • Critical 9.8
    CVE-2023-26540

    WordPress Houzez theme <= 2.7.1 - Privilege Escalation

    Improper Privilege Management vulnerability in Favethemes Houzez allows Privilege Escalation.This issue affects Houzez: from n/a through 2.7.1.

    favethemes Houzez
  • Critical 9.8
    CVE-2023-26009

    WordPress Houzez Login Register plugin <= 2.6.3 - Privilege Escalation

    Improper Privilege Management vulnerability in Favethemes Houzez Login Register allows Privilege Escalation.This issue affects Houzez Login Register: from n/a through 2.6.3.

    favethemes Houzez Login Register
  • High 8.2
    CVE-2023-29432

    WordPress Houzez Theme < 2.8.3 is vulnerable to SQL Injection

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Favethemes Houzez - Real Estate WordPress Theme.This issue affects Houzez - Real Estate WordPress Theme: from n/a before 2.8.3.

    favethemes Houzez - Real Estate WordPress Theme Web / CMS
  • Critical 9.9
    CVE-2023-36529

    WordPress Houzez CRM Plugin <= 1.3.4 is vulnerable to SQL Injection

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Favethemes Houzez - Real Estate WordPress Theme allows SQL Injection.This issue affects Houzez - Real Estate WordPress Theme: from n/a through 1.3.4.

    favethemes Houzez - Real Estate WordPress Theme Web / CMS