Houzez vulnerabilities | LiveThreat CVE Feed — Verisq

Login Request a demo

HO

Product

Houzez

by favethemes · last CVE Nov 26, 2025

19

CVEs

0

On KEV

9.8

Max CVSS

0

New 30D

Vulnerabilities19 In the news0 Timeline

Severity mix

Critical 4High 8Medium 7Low 0

Severity

All severities19 Critical4 High8 Medium7 Low0

Exploitation

On CISA KEV0 Exploited in the wild0

Watch

Add Houzez to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2023-26540	9.8	3%	May 17	WordPress Houzez theme <= 2.7.1 - Privilege Escalation Affected: through 2.7.1
CVE-2023-26009	9.8	3%	May 17	WordPress Houzez Login Register plugin <= 2.6.3 - Privilege Escalation Affected: through 2.6.3
CVE-2023-29432	9.8	1%	Dec 20	WordPress Houzez Theme < 2.8.3 is vulnerable to SQL Injection Affected: before 2.8.3
CVE-2023-36529	9.8	1%	Nov 3	WordPress Houzez CRM Plugin <= 1.3.4 is vulnerable to SQL Injection Affected: through 1.3.4
CVE-2025-49407	8.8	0%	Aug 28	WordPress Houzez Theme <= 4.1.1 - Cross Site Scripting (XSS) Vulnerability Affected: through 4.1.1
CVE-2024-22303	8.8	0%	Sep 17	WordPress Houzez theme <= 3.2.4 - Privilege Escalation vulnerability Affected: through 3.2.4
CVE-2024-21743	8.8	0%	Sep 17	WordPress Houzez Login Register plugin <= 3.2.5 - Privilege Escalation vulnerability Affected: through 3.2.5
CVE-2024-5793	8.8	0%	Jul 9	Houzez Theme - Functionality <= 3.2.2 - Authenticated (Seller+) SQL Injection Affected: through 3.2.2
CVE-2025-49406	8.5	0%	Aug 20	WordPress Houzez Theme <= 4.1.1 - Broken Access Control Vulnerability Affected: through 4.1.1
CVE-2025-62053	8.1	0%	Nov 6	WordPress Houzez theme < 4.2.0 - Local File Inclusion vulnerability Affected: through 4.2.0
CVE-2025-53198	8.1	1%	Aug 20	WordPress Houzez theme <= 4.0.4 - Local File Inclusion Vulnerability Affected: through 4.0.4
CVE-2024-43244	7.1	0%	Aug 18	WordPress houzez Theme By FaveThemes <= 3.2.4 - Cross Site Scripting (XSS) vulnerability Affected: through 3.2.4
CVE-2025-49952	6.5	0%	Oct 22	WordPress Houzez theme <= 4.2.5 - Insecure Direct Object References (IDOR) vulnerability Affected: through 4.2.5
CVE-2025-9191	6.3	0%	Nov 26	Houzez <= 4.1.6 - Authenticated (Subscriber+) PHP Object Injection via Saved Search Affected: through 4.1.6
CVE-2025-9163	6.1	0%	Nov 26	Houzez <= 4.1.6 - Unauthenticated Stored Cross-Site Scripting via SVG File Upload Affected: through 4.1.6
CVE-2025-24747	5.3	0%	Jan 27	WordPress Houzez theme <= 3.4.0 - Broken Access Control vulnerability Affected: through 3.4.0
CVE-2025-49405	4.3	0%	Aug 28	WordPress Houzez Theme < 4.1.4 - Local File Inclusion Vulnerability Affected: before 4.1.4
CVE-2025-53997	4.3	0%	Jul 16	WordPress Houzez theme <= 4.0.4 - Broken Access Control Vulnerability Affected: through 4.0.4
CVE-2025-24754	4.3	0%	Jan 27	WordPress Houzez theme <= 3.4.0 - Broken Access Control vulnerability Affected: through 3.4.0