favethemes vulnerabilities and threats

27 threats

Severity	CVSS	Signals	Threat	Source	Published
Medium	5.3	EPSS 0.3%	CVE-2025-24747Houzez (WordPress plugin) · Missing Authorization Medium5.3EPSS 0.3%2025-01-27CVE Database V5CVE-2025-24747 Missing Authorization vulnerability in favethemes Houzez houzez.This issue affects Houzez: from n/a through <= 3.4.0. EPSS 0.3%Vulnerability favethemes	CVE Database V5	2025-01-27
Medium	4.3	EPSS 0.2%	CVE-2025-24754Houzez (WordPress plugin) · Missing Authorization Medium4.3EPSS 0.2%2025-01-27CVE Database V5CVE-2025-24754 Missing Authorization vulnerability in favethemes Houzez houzez.This issue affects Houzez: from n/a through <= 3.4.0. EPSS 0.2%Vulnerability favethemes	CVE Database V5	2025-01-27
Critical	9.8	EPSS 0.4%	CVE-2024-51888Homey Login Register (WordPress plugin) · Incorrect Privilege Assignment Critical9.8EPSS 0.4%2025-01-21CVE Database V5CVE-2024-51888 Incorrect Privilege Assignment vulnerability in favethemes Homey Login Register homey-login-register allows Privilege Escalation.This issue affects Homey Login Register: from n/a through <= 2.4.0. EPSS 0.4%Vulnerability favethemes	CVE Database V5	2025-01-21
High	8.8	EPSS 0.4%	CVE-2024-22303Houzez (WordPress plugin) · Incorrect Privilege Assignment High8.8EPSS 0.4%2024-09-17CVE Database V5CVE-2024-22303 Incorrect Privilege Assignment vulnerability in favethemes Houzez allows Privilege Escalation.This issue affects Houzez: from n/a through 3.2.4. EPSS 0.4%Vulnerability favethemes CWE-266	CVE Database V5	2024-09-17
High	8.8	EPSS 0.4%	CVE-2024-21743Houzez Login Register (WordPress plugin) · Incorrect Privilege Assignment High8.8EPSS 0.4%2024-09-17CVE Database V5CVE-2024-21743 Privilege Escalation vulnerability in favethemes Houzez Login Register houzez-login-register.This issue affects Houzez Login Register: from n/a through 3.2.5. EPSS 0.4%Vulnerability favethemes CWE-266	CVE Database V5	2024-09-17
High	7.1	EPSS 0.3%	CVE-2024-43244Houzez (WordPress plugin) · XSS or 'Cross-site Scripting' High7.1EPSS 0.3%2024-08-18CVE Database V5CVE-2024-43244 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in favethemes Houzez allows Reflected XSS.This issue affects Houzez: from n/a through 3.2.4. EPSS 0.3%Vulnerability favethemes CWE-79	CVE Database V5	2024-08-18
High	8.8	EPSS 0.5%	CVE-2024-5793Favethemes Houzez Theme – Functionality · SQL Injection High8.8EPSS 0.5%2024-07-09CVE Database V5CVE-2024-5793 The Houzez Theme - Functionality plugin for WordPress is vulnerable to SQL Injection via the ‘currency_code’ parameter in all versions up to, and including, 3.2.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Custom-level (seller) access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. EPSS 0.5%Vulnerability CWE-89	CVE Database V5	2024-07-09

Page 2 of 2