Skip to content
OpenAdvisories

Vendor

favethemes

31 known vulnerabilities.

Products

Houzez 14 Houzez Theme - Functionality 5 Houzez Login Register 3 Homey 3 Homey Core 2 Houzez - Real Estate WordPress Theme 2 Homey Login Register 1 MLS On The Fly 1
All Critical High Medium Low Exploited only Public exploit

10 results · Clear filters · Feed

  • Medium 6.5
    CVE-2026-24355

    WordPress Houzez Theme - Functionality plugin <= 4.2.6 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in favethemes Houzez Theme - Functionality houzez-theme-functionality allows Stored XSS.This issue affects Houzez Theme - Functionality: from n/a through <= 4.2…

    favethemes Houzez Theme - Functionality
  • Medium 5.3
    CVE-2025-67965

    WordPress Homey Core plugin <= 2.4.3 - Broken Access Control vulnerability

    Missing Authorization vulnerability in favethemes Homey Core homey-core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Homey Core: from n/a through <= 2.4.3.

    favethemes Homey Core
  • Medium 6.1
    CVE-2025-9163

    Houzez <= 4.1.6 - Unauthenticated Stored Cross-Site Scripting via SVG File Upload

    The Houzez theme for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 4.1.6 due to insufficient input sanitization and output escaping in the houzez_property_img_upload() and houzez_property_att…

    favethemes Houzez Web / CMS
  • Medium 6.3
    CVE-2025-9191

    Houzez <= 4.1.6 - Authenticated (Subscriber+) PHP Object Injection via Saved Search

    The Houzez theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.1.6 via deserialization of untrusted input in saved-search-item.php. This makes it possible for authenticated attackers, with Subscriber-level access …

    favethemes Houzez Web / CMS
  • Medium 6.5
    CVE-2025-62058

    WordPress Houzez Theme - Functionality plugin < 4.2.0 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in favethemes Houzez Theme - Functionality houzez-theme-functionality.This issue affects Houzez Theme - Functionality: from n/a through < 4.2.0.

    favethemes Houzez Theme - Functionality
  • Medium 6.5
    CVE-2025-49952

    WordPress Houzez theme <= 4.2.5 - Insecure Direct Object References (IDOR) vulnerability

    Authorization Bypass Through User-Controlled Key vulnerability in favethemes Houzez houzez allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Houzez: from n/a through <= 4.2.5.

    favethemes Houzez
  • Medium 4.3
    CVE-2025-49405

    WordPress Houzez Theme < 4.1.4 - Local File Inclusion Vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Favethemes Houzez allows PHP Local File Inclusion.This issue affects Houzez: from n/a before 4.1.4.

    favethemes Houzez
  • Medium 4.3
    CVE-2025-53997

    WordPress Houzez theme <= 4.0.4 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in favethemes Houzez houzez allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Houzez: from n/a through <= 4.0.4.

    favethemes Houzez
  • Medium 5.3
    CVE-2025-24747

    WordPress Houzez theme <= 3.4.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in favethemes Houzez houzez.This issue affects Houzez: from n/a through <= 3.4.0.

    favethemes Houzez
  • Medium 4.3
    CVE-2025-24754

    WordPress Houzez theme <= 3.4.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in favethemes Houzez houzez.This issue affects Houzez: from n/a through <= 3.4.0.

    favethemes Houzez