Favethemes vulnerabilities and threats

27 threats

Severity	CVSS	Signals	Threat	Source	Published
High	8.5		CVE-2026-61996MLS On The Fly (WordPress plugin) · SQL Injection High8.52026-10-29CVE Database V5CVE-2026-61996 Subscriber SQL Injection in MLS On The Fly <= 1.8.1.5 versions. Vulnerability favethemes CWE-89	CVE Database V5	2026-10-29
High	8.2	EPSS 0.3%	CVE-2026-57768Houzez Login Register (WordPress plugin) · Incorrect Privilege Assignment High8.2EPSS 0.3%2026-07-13CVE Database V5CVE-2026-57768 Incorrect Privilege Assignment vulnerability in favethemes Houzez Login Register houzez-login-register allows Privilege Escalation.This issue affects Houzez Login Register: from n/a through <= 3.3.3. EPSS 0.3%Vulnerability favethemes CWE-266	CVE Database V5	2026-07-13
Medium	6.5	EPSS 0.2%	CVE-2026-24355Houzez Theme – Functionality · Cross-site Scripting Medium6.5EPSS 0.2%2026-01-22CVE Database V5CVE-2026-24355 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in favethemes Houzez Theme - Functionality houzez-theme-functionality allows Stored XSS.This issue affects Houzez Theme - Functionality: from n/a through <= 4.2.6. EPSS 0.2%Vulnerability favethemes	CVE Database V5	2026-01-22
High	7.1	EPSS 0.3%	CVE-2025-67964Homey Core (WordPress plugin) · Cross-site Scripting High7.1EPSS 0.3%2026-01-22CVE Database V5CVE-2025-67964 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in favethemes Homey Core homey-core allows Reflected XSS.This issue affects Homey Core: from n/a through <= 2.4.3. EPSS 0.3%Vulnerability favethemes	CVE Database V5	2026-01-22
Medium	5.3	EPSS 0.3%	CVE-2025-67965Homey Core (WordPress plugin) · Missing Authorization Medium5.3EPSS 0.3%2025-12-16CVE Database V5CVE-2025-67965 Missing Authorization vulnerability in favethemes Homey Core homey-core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Homey Core: from n/a through <= 2.4.3. EPSS 0.3%Vulnerability favethemes	CVE Database V5	2025-12-16
Medium	6.1	EPSS 0.2%	CVE-2025-9163Houzez (WordPress theme) · Cross-site Scripting Medium6.1EPSS 0.2%2025-11-26CVE Database V5CVE-2025-9163 The Houzez theme for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 4.1.6 due to insufficient input sanitization and output escaping in the houzez_property_img_upload() and houzez_property_attachment_upload() functions. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file. EPSS 0.2%Vulnerability favethemes CWE-79	CVE Database V5	2025-11-26
Medium	6.3	EPSS 0.3%	CVE-2025-9191Houzez (WordPress plugin) · Deserialization of Untrusted Data Medium6.3EPSS 0.3%2025-11-26CVE Database V5CVE-2025-9191 The Houzez theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.1.6 via deserialization of untrusted input in saved-search-item.php. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present. EPSS 0.3%Vulnerability favethemes CWE-502	CVE Database V5	2025-11-26
High	7.1	EPSS 0.2%	CVE-2025-62057Houzez Theme – Functionality · Cross-site Scripting High7.1EPSS 0.2%2025-11-06CVE Database V5CVE-2025-62057 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in favethemes Houzez Theme - Functionality houzez-theme-functionality.This issue affects Houzez Theme - Functionality: from n/a through < 4.2.0. EPSS 0.2%Vulnerability favethemes	CVE Database V5	2025-11-06
High	8.1	EPSS 0.4%	CVE-2025-62053Houzez (WordPress plugin) · Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File High8.1EPSS 0.4%2025-11-06CVE Database V5CVE-2025-62053 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in favethemes Houzez houzez.This issue affects Houzez: from n/a through < 4.2.0. EPSS 0.4%Vulnerability favethemes	CVE Database V5	2025-11-06
Medium	6.5	EPSS 0.2%	CVE-2025-62058Houzez Theme – Functionality · Cross-site Scripting Medium6.5EPSS 0.2%2025-10-22CVE Database V5CVE-2025-62058 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in favethemes Houzez Theme - Functionality houzez-theme-functionality.This issue affects Houzez Theme - Functionality: from n/a through < 4.2.0. EPSS 0.2%Vulnerability favethemes	CVE Database V5	2025-10-22
High	7.5	EPSS 0.4%	CVE-2025-62054Houzez Theme – Functionality · Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File High7.5EPSS 0.4%2025-10-22CVE Database V5CVE-2025-62054 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in favethemes Houzez Theme - Functionality houzez-theme-functionality.This issue affects Houzez Theme - Functionality: from n/a through <= 4.1.8. EPSS 0.4%Vulnerability favethemes	CVE Database V5	2025-10-22
Medium	6.5	EPSS 0.4%	CVE-2025-49952Houzez (WordPress plugin) · Insecure Direct Object Reference Medium6.5EPSS 0.4%2025-10-22CVE Database V5CVE-2025-49952 Authorization Bypass Through User-Controlled Key vulnerability in favethemes Houzez houzez allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Houzez: from n/a through <= 4.2.5. EPSS 0.4%Vulnerability favethemes	CVE Database V5	2025-10-22
High	8.8	EPSS 0.4%	CVE-2025-49407Houzez (WordPress plugin) · Cross-site Scripting High8.8EPSS 0.4%2025-08-28CVE Database V5CVE-2025-49407 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in favethemes Houzez allows Reflected XSS. This issue affects Houzez: from n/a through 4.1.1. EPSS 0.4%Vulnerability favethemes CWE-79	CVE Database V5	2025-08-28
Medium	4.3	EPSS 0.3%	CVE-2025-49405Houzez (WordPress plugin) · PHP Remote File Inclusion Medium4.3EPSS 0.3%2025-08-28CVE Database V5CVE-2025-49405 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Favethemes Houzez allows PHP Local File Inclusion.This issue affects Houzez: from n/a before 4.1.4. EPSS 0.3%Vulnerability Favethemes CWE-98	CVE Database V5	2025-08-28
High	8.5	EPSS 0.3%	CVE-2025-49406Houzez (WordPress plugin) · Missing Authorization High8.5EPSS 0.3%2025-08-20CVE Database V5CVE-2025-49406 Missing Authorization vulnerability in favethemes Houzez allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Houzez: from n/a through 4.1.1. EPSS 0.3%Vulnerability favethemes CWE-862	CVE Database V5	2025-08-20
High	8.1	EPSS 0.7%	CVE-2025-53198Houzez (WordPress plugin) · Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File High8.1EPSS 0.7%2025-08-20CVE Database V5CVE-2025-53198 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in favethemes Houzez houzez allows PHP Local File Inclusion.This issue affects Houzez: from n/a through <= 4.0.4. EPSS 0.7%Vulnerability favethemes	CVE Database V5	2025-08-20
Medium	4.3	EPSS 0.3%	CVE-2025-53997Houzez (WordPress plugin) · Missing Authorization Medium4.3EPSS 0.3%2025-07-16CVE Database V5CVE-2025-53997 Missing Authorization vulnerability in favethemes Houzez houzez allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Houzez: from n/a through <= 4.0.4. EPSS 0.3%Vulnerability favethemes	CVE Database V5	2025-07-16
High	7.1	EPSS 0.3%	CVE-2025-31037Homey (WordPress plugin) · Cross-site Scripting High7.1EPSS 0.3%2025-07-04CVE Database V5CVE-2025-31037 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in favethemes Homey homey allows Reflected XSS.This issue affects Homey: from n/a through <= 2.4.5. EPSS 0.3%Vulnerability favethemes	CVE Database V5	2025-07-04
Critical	9.3	EPSS 0.3%	CVE-2025-52834Homey (WordPress plugin) · SQL Injection Critical9.3EPSS 0.3%2025-06-27CVE Database V5CVE-2025-52834 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in favethemes Homey homey allows SQL Injection.This issue affects Homey: from n/a through <= 2.4.7. EPSS 0.3%Vulnerability favethemes	CVE Database V5	2025-06-27
Critical	9.8	EPSS 0.5%	CVE-2024-51800Homey (WordPress plugin) · Incorrect Privilege Assignment Critical9.8EPSS 0.5%2025-04-04CVE Database V5CVE-2024-51800 Incorrect Privilege Assignment vulnerability in Favethemes Homey allows Privilege Escalation.This issue affects Homey: from n/a through 2.4.1. EPSS 0.5%Vulnerability Favethemes CWE-266	CVE Database V5	2025-04-04

Page 1 of 2