Skip to content
OpenAdvisories

Vendor

Fave Themes

37 known vulnerabilities.

Products

Houzez 14 Homey 8 Houzez Theme - Functionality 5 Houzez Login Register 3 Homey Core 2 Homey Login Register 2 Houzez - Real Estate WordPress Theme 2 MLS On The Fly 1
All Critical High Medium Low Exploited only Public exploit

16 results · Clear filters · Feed

  • High 8.5
    CVE-2026-61996

    WordPress MLS On The Fly plugin <= 1.8.1.5 - SQL Injection vulnerability

    Subscriber SQL Injection in MLS On The Fly <= 1.8.1.5 versions.

    Fave Themes MLS On The Fly
  • High 8.2
    CVE-2026-57768

    WordPress Houzez Login Register plugin <= 3.3.3 - Privilege Escalation vulnerability

    Incorrect Privilege Assignment vulnerability in favethemes Houzez Login Register houzez-login-register allows Privilege Escalation.This issue affects Houzez Login Register: from n/a through <= 3.3.3.

    Fave Themes Houzez Login Register
  • High 7.1
    CVE-2025-67964

    WordPress Homey Core plugin <= 2.4.3 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in favethemes Homey Core homey-core allows Reflected XSS.This issue affects Homey Core: from n/a through <= 2.4.3.

    Fave Themes Homey Core
  • High 7.1
    CVE-2025-62057

    WordPress Houzez Theme - Functionality plugin < 4.2.0 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in favethemes Houzez Theme - Functionality houzez-theme-functionality.This issue affects Houzez Theme - Functionality: from n/a through < 4.2.0.

    Fave Themes Houzez Theme - Functionality
  • High 8.1
    CVE-2025-62053

    WordPress Houzez theme < 4.2.0 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in favethemes Houzez houzez.This issue affects Houzez: from n/a through < 4.2.0.

    Fave Themes Houzez
  • High 7.5
    CVE-2025-62054

    WordPress Houzez Theme - Functionality plugin <= 4.1.8 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in favethemes Houzez Theme - Functionality houzez-theme-functionality.This issue affects Houzez Theme - Functionality: from n/a through <= 4.…

    Fave Themes Houzez Theme - Functionality
  • High 8.8
    CVE-2025-49407

    WordPress Houzez Theme <= 4.1.1 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in favethemes Houzez allows Reflected XSS. This issue affects Houzez: from n/a through 4.1.1.

    Fave Themes Houzez
  • High 8.5
    CVE-2025-49406

    WordPress Houzez Theme <= 4.1.1 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in favethemes Houzez allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Houzez: from n/a through 4.1.1.

    Fave Themes Houzez
  • High 8.1
    CVE-2025-53198

    WordPress Houzez theme <= 4.0.4 - Local File Inclusion Vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in favethemes Houzez houzez allows PHP Local File Inclusion.This issue affects Houzez: from n/a through <= 4.0.4.

    Fave Themes Houzez
  • High 7.1
    CVE-2025-31037

    WordPress Homey theme <= 2.4.5 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in favethemes Homey homey allows Reflected XSS.This issue affects Homey: from n/a through <= 2.4.5.

    Fave Themes Homey
  • High 8.1
    CVE-2025-0749

    Homey <= 2.4.3 - Limited Authentication Bypass due to Missing Empty Value Check

    The Homey theme for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.4.3. This is due to the 'verification_id' value being set to empty, and the not empty check is missing in the dashboard user profile page. This makes it p…

    Fave Themes Homey Web / CMS
  • High 8.8
    CVE-2024-22303

    WordPress Houzez theme <= 3.2.4 - Privilege Escalation vulnerability

    Incorrect Privilege Assignment vulnerability in favethemes Houzez allows Privilege Escalation.This issue affects Houzez: from n/a through 3.2.4.

    Fave Themes Houzez
  • High 8.8
    CVE-2024-21743

    WordPress Houzez Login Register plugin <= 3.2.5 - Privilege Escalation vulnerability

    Privilege Escalation vulnerability in favethemes Houzez Login Register houzez-login-register.This issue affects Houzez Login Register: from n/a through 3.2.5.

    Fave Themes Houzez Login Register
  • High 7.1
    CVE-2024-43244

    WordPress houzez Theme By FaveThemes <= 3.2.4 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in favethemes Houzez allows Reflected XSS.This issue affects Houzez: from n/a through 3.2.4.

    Fave Themes Houzez
  • High 8.8
    CVE-2024-5793

    Houzez Theme - Functionality <= 3.2.2 - Authenticated (Seller+) SQL Injection

    The Houzez Theme - Functionality plugin for WordPress is vulnerable to SQL Injection via the ‘currency_code’ parameter in all versions up to, and including, 3.2.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation o…

    Fave Themes Houzez Theme - Functionality Web / CMS
  • High 8.2
    CVE-2023-29432

    WordPress Houzez Theme < 2.8.3 is vulnerable to SQL Injection

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Favethemes Houzez - Real Estate WordPress Theme.This issue affects Houzez - Real Estate WordPress Theme: from n/a before 2.8.3.

    Fave Themes Houzez - Real Estate WordPress Theme Web / CMS