Houzez vulnerabilities

10 known vulnerabilities in Houzez from Favethemes. 10 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.1 High severity

  Houzez: Improper Control of Filename for Include/Require Statement in PHP Program

  CVE-2025-62053Nov 6, 2025Favethemes

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in favethemes Houzez houzez.This issue affects Houzez: from n/a through < 4.2.0.

• 8.8 High severity

  Houzez: Improper Neutralization of Input During Web Page Generation

  CVE-2025-49407Aug 28, 2025Favethemes

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in favethemes Houzez allows Reflected XSS. This issue affects Houzez: from n/a through 4.1.1.

• 8.1 High severity

  Houzez: Improper Control of Filename for Include/Require Statement in PHP Program

  CVE-2025-53198Aug 20, 2025Favethemes

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in favethemes Houzez houzez allows PHP Local File Inclusion.This issue affects Houzez: from n/a through <= 4.0.4.

• 8.5 High severity

  Houzez: Missing Authorization

  CVE-2025-49406Aug 20, 2025Favethemes

  Missing Authorization vulnerability in favethemes Houzez allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Houzez: from n/a through 4.1.1.

• 8.8 High severity

  Houzez Login Register: Incorrect Privilege Assignment

  CVE-2024-21743Sep 17, 2024Favethemes

  Privilege Escalation vulnerability in favethemes Houzez Login Register houzez-login-register.This issue affects Houzez Login Register: from n/a through 3.2.5.

• 7.1 High severity

  Houzez: Improper Neutralization of Input During Web Page Generation

  CVE-2024-43244Aug 18, 2024Favethemes

  Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in favethemes Houzez allows Reflected XSS.This issue affects Houzez: from n/a through 3.2.4.

• 8.8 High severity

  Houzez Theme - Functionality: Improper Neutralization of Special Elements used in an SQL Command

  CVE-2024-5793Jul 9, 2024Favethemes

  The Houzez Theme - Functionality plugin for WordPress is vulnerable to SQL Injection via the ‘currency_code’ parameter in all versions up to, and including, 3.2.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on

• 9.8 Critical severity

  Houzez Login Register: Improper Privilege Management

  CVE-2023-26009May 17, 2024FavethemesEPSS 2.73%

  Improper Privilege Management vulnerability in Favethemes Houzez Login Register allows Privilege Escalation.This issue affects Houzez Login Register: from n/a through 2.6.3.

• 9.8 Critical severity

  Houzez - Real Estate WordPress Theme: Improper Neutralization of Special Elements used in an SQL Command

  CVE-2023-29432Dec 20, 2023Favethemes

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Favethemes Houzez - Real Estate WordPress Theme.This issue affects Houzez - Real Estate WordPress Theme: from n/a before 2.8.3.

• 9.8 Critical severity

  Houzez - Real Estate WordPress Theme: Improper Neutralization of Special Elements used in an SQL Command

  CVE-2023-36529Nov 3, 2023Favethemes

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Favethemes Houzez - Real Estate WordPress Theme allows SQL Injection.This issue affects Houzez - Real Estate WordPress Theme: from n/a through 1.3.4.