Skip to content
OpenAdvisories

Product · Fave Themes

Houzez

14 known vulnerabilities.

Houzez at a glance

Last 12 months
2
Critical · all time
1
Exploited · all time
0
Public exploit · all time
0
New vulnerabilities per month · last 12 months
0 1 1 December 2025: 0 vulnerabilities Dec 2025 January 2026: 0 vulnerabilities February 2026: 0 vulnerabilities March 2026: 0 vulnerabilities Mar April 2026: 0 vulnerabilities May 2026: 0 vulnerabilities June 2026: 0 vulnerabilities Jun July 2026: 0 vulnerabilities August 2026: 0 vulnerabilities September 2026: 0 vulnerabilities Sep October 2026: 0 vulnerabilities November 2026: 0 vulnerabilities
Show as table
MonthVulnerabilitiesCritical
Nov 202600
Oct 202600
Sep 202600
Aug 202600
Jul 202600
Jun 202600
May 202600
Apr 202600
Mar 202600
Feb 202600
Jan 202600
Dec 202500
Nov 202530
Oct 202510
Sep 202500
Aug 202540
Jul 202510
Jun 202500
May 202500
Apr 202500
Mar 202500
Feb 202500
Jan 202520
Dec 202400
All Critical High Medium Low Exploited only Public exploit

14 results · Feed

  • Medium 6.1
    CVE-2025-9163

    Houzez <= 4.1.6 - Unauthenticated Stored Cross-Site Scripting via SVG File Upload

    The Houzez theme for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 4.1.6 due to insufficient input sanitization and output escaping in the houzez_property_img_upload() and houzez_property_att…

    Fave Themes Houzez Web / CMS
  • Medium 6.3
    CVE-2025-9191

    Houzez <= 4.1.6 - Authenticated (Subscriber+) PHP Object Injection via Saved Search

    The Houzez theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.1.6 via deserialization of untrusted input in saved-search-item.php. This makes it possible for authenticated attackers, with Subscriber-level access …

    Fave Themes Houzez Web / CMS
  • High 8.1
    CVE-2025-62053

    WordPress Houzez theme < 4.2.0 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in favethemes Houzez houzez.This issue affects Houzez: from n/a through < 4.2.0.

    Fave Themes Houzez
  • Medium 6.5
    CVE-2025-49952

    WordPress Houzez theme <= 4.2.5 - Insecure Direct Object References (IDOR) vulnerability

    Authorization Bypass Through User-Controlled Key vulnerability in favethemes Houzez houzez allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Houzez: from n/a through <= 4.2.5.

    Fave Themes Houzez
  • High 8.8
    CVE-2025-49407

    WordPress Houzez Theme <= 4.1.1 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in favethemes Houzez allows Reflected XSS. This issue affects Houzez: from n/a through 4.1.1.

    Fave Themes Houzez
  • Medium 4.3
    CVE-2025-49405

    WordPress Houzez Theme < 4.1.4 - Local File Inclusion Vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Favethemes Houzez allows PHP Local File Inclusion.This issue affects Houzez: from n/a before 4.1.4.

    Fave Themes Houzez
  • High 8.5
    CVE-2025-49406

    WordPress Houzez Theme <= 4.1.1 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in favethemes Houzez allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Houzez: from n/a through 4.1.1.

    Fave Themes Houzez
  • High 8.1
    CVE-2025-53198

    WordPress Houzez theme <= 4.0.4 - Local File Inclusion Vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in favethemes Houzez houzez allows PHP Local File Inclusion.This issue affects Houzez: from n/a through <= 4.0.4.

    Fave Themes Houzez
  • Medium 4.3
    CVE-2025-53997

    WordPress Houzez theme <= 4.0.4 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in favethemes Houzez houzez allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Houzez: from n/a through <= 4.0.4.

    Fave Themes Houzez
  • Medium 5.3
    CVE-2025-24747

    WordPress Houzez theme <= 3.4.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in favethemes Houzez houzez.This issue affects Houzez: from n/a through <= 3.4.0.

    Fave Themes Houzez
  • Medium 4.3
    CVE-2025-24754

    WordPress Houzez theme <= 3.4.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in favethemes Houzez houzez.This issue affects Houzez: from n/a through <= 3.4.0.

    Fave Themes Houzez
  • High 8.8
    CVE-2024-22303

    WordPress Houzez theme <= 3.2.4 - Privilege Escalation vulnerability

    Incorrect Privilege Assignment vulnerability in favethemes Houzez allows Privilege Escalation.This issue affects Houzez: from n/a through 3.2.4.

    Fave Themes Houzez
  • High 7.1
    CVE-2024-43244

    WordPress houzez Theme By FaveThemes <= 3.2.4 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in favethemes Houzez allows Reflected XSS.This issue affects Houzez: from n/a through 3.2.4.

    Fave Themes Houzez
  • Critical 9.8
    CVE-2023-26540

    WordPress Houzez theme <= 2.7.1 - Privilege Escalation

    Improper Privilege Management vulnerability in Favethemes Houzez allows Privilege Escalation.This issue affects Houzez: from n/a through 2.7.1.

    Fave Themes Houzez