favethemes vulnerabilities

Products

• houzez 19
• Homey 5
• Houzez Theme - Functionality 5
• Houzez Login Register 3
• Homey Core 2
• Houzez - Real Estate WordPress Theme 2
• Homey Login Register 1
• MLS On The Fly 1

Latest favethemes CVEs

Newest publication first · page 1 of 2

1. CVE-2026-61996 WordPress MLS On The Fly plugin <= 1.8.1.5 - SQL Injection vulnerability

   Published 2026-10-29

   High·CVSS 8.5 EPSS 0.38%

   Subscriber SQL Injection in MLS On The Fly <= 1.8.1.5 versions.

2. CVE-2026-57768 WordPress Houzez Login Register plugin <= 3.3.3 - Privilege Escalation vulnerability

   Published 2026-07-13

   High·CVSS 8.2 EPSS 0.32%

   Incorrect Privilege Assignment vulnerability in favethemes Houzez Login Register houzez-login-register allows Privilege Escalation.This issue affects Houzez Login Register: from n/a through <= 3.3.3.

3. CVE-2026-24355 WordPress Houzez Theme - Functionality plugin <= 4.2.6 - Cross Site Scripting (XSS) vulnerability

   Published 2026-01-22

   Medium·CVSS 6.5 EPSS 0.15%

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in favethemes Houzez Theme - Functionality houzez-theme-functionality allows Stored XSS.This issue affects Houzez Theme - Functionality: from n/a through <= 4.2.6.

4. CVE-2025-67964 WordPress Homey Core plugin <= 2.4.3 - Cross Site Scripting (XSS) vulnerability

   Published 2026-01-22

   High·CVSS 7.1 EPSS 0.29%

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in favethemes Homey Core homey-core allows Reflected XSS.This issue affects Homey Core: from n/a through <= 2.4.3.

5. CVE-2025-67965 WordPress Homey Core plugin <= 2.4.3 - Broken Access Control vulnerability

   Published 2025-12-16

   Medium·CVSS 5.3 EPSS 0.33%

   Missing Authorization vulnerability in favethemes Homey Core homey-core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Homey Core: from n/a through <= 2.4.3.

6. CVE-2025-9163 Houzez <= 4.1.6 - Unauthenticated Stored Cross-Site Scripting via SVG File Upload

   Published 2025-11-26

   Medium·CVSS 6.1 EPSS 0.22%

   The Houzez theme for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 4.1.6 due to insufficient input sanitization and output escaping in the houzez_property_img_upload() and houzez_property_attachment_upload() func...

7. CVE-2025-9191 Houzez <= 4.1.6 - Authenticated (Subscriber+) PHP Object Injection via Saved Search

   Published 2025-11-26

   Medium·CVSS 6.3 EPSS 0.28%

   The Houzez theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.1.6 via deserialization of untrusted input in saved-search-item.php. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject...

8. CVE-2025-62057 WordPress Houzez Theme - Functionality plugin < 4.2.0 - Cross Site Scripting (XSS) vulnerability

   Published 2025-11-06

   High·CVSS 7.1 EPSS 0.24%

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in favethemes Houzez Theme - Functionality houzez-theme-functionality.This issue affects Houzez Theme - Functionality: from n/a through < 4.2.0.

9. CVE-2025-62053 WordPress Houzez theme < 4.2.0 - Local File Inclusion vulnerability

   Published 2025-11-06

   High·CVSS 8.1 EPSS 0.43%

   Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in favethemes Houzez houzez.This issue affects Houzez: from n/a through < 4.2.0.

10. CVE-2025-62054 WordPress Houzez Theme - Functionality plugin <= 4.1.8 - Local File Inclusion vulnerability

    Published 2025-10-22

    High·CVSS 7.5 EPSS 0.43%

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in favethemes Houzez Theme - Functionality houzez-theme-functionality.This issue affects Houzez Theme - Functionality: from n/a through <= 4.1.8.

11. CVE-2025-62058 WordPress Houzez Theme - Functionality plugin < 4.2.0 - Cross Site Scripting (XSS) vulnerability

    Published 2025-10-22

    Medium·CVSS 6.5 EPSS 0.18%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in favethemes Houzez Theme - Functionality houzez-theme-functionality.This issue affects Houzez Theme - Functionality: from n/a through < 4.2.0.

12. CVE-2025-49952 WordPress Houzez theme <= 4.2.5 - Insecure Direct Object References (IDOR) vulnerability

    Published 2025-10-22

    Medium·CVSS 6.5 EPSS 0.44%

    Authorization Bypass Through User-Controlled Key vulnerability in favethemes Houzez houzez allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Houzez: from n/a through <= 4.2.5.

13. CVE-2025-49407 WordPress Houzez Theme <= 4.1.1 - Cross Site Scripting (XSS) Vulnerability

    Published 2025-08-28

    High·CVSS 8.8 EPSS 0.44%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in favethemes Houzez allows Reflected XSS. This issue affects Houzez: from n/a through 4.1.1.

14. CVE-2025-49405 WordPress Houzez Theme < 4.1.4 - Local File Inclusion Vulnerability

    Published 2025-08-28

    Medium·CVSS 4.3 EPSS 0.27%

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Favethemes Houzez allows PHP Local File Inclusion.This issue affects Houzez: from n/a before 4.1.4.

15. CVE-2025-49406 WordPress Houzez Theme <= 4.1.1 - Broken Access Control Vulnerability

    Published 2025-08-20

    High·CVSS 8.5 EPSS 0.38%

    Missing Authorization vulnerability in favethemes Houzez allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Houzez: from n/a through 4.1.1.

16. CVE-2025-53198 WordPress Houzez theme <= 4.0.4 - Local File Inclusion Vulnerability

    Published 2025-08-20

    High·CVSS 8.1 EPSS 0.72%

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in favethemes Houzez houzez allows PHP Local File Inclusion.This issue affects Houzez: from n/a through <= 4.0.4.

17. CVE-2025-53997 WordPress Houzez theme <= 4.0.4 - Broken Access Control Vulnerability

    Published 2025-07-16

    Medium·CVSS 4.3 EPSS 0.28%

    Missing Authorization vulnerability in favethemes Houzez houzez allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Houzez: from n/a through <= 4.0.4.

18. CVE-2025-31037 WordPress Homey theme <= 2.4.5 - Reflected Cross Site Scripting (XSS) vulnerability

    Published 2025-07-04

    High·CVSS 7.1 EPSS 0.26%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in favethemes Homey homey allows Reflected XSS.This issue affects Homey: from n/a through <= 2.4.5.

19. CVE-2025-52834 WordPress Homey theme <= 2.4.7 - SQL Injection vulnerability

    Published 2025-06-27

    Critical·CVSS 9.3 EPSS 0.32%

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in favethemes Homey homey allows SQL Injection.This issue affects Homey: from n/a through <= 2.4.7.

20. CVE-2025-1326 Homey - Booking and Rentals WordPress Theme <= 2.4.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Reservation & Post Deletion

    Published 2025-05-02

    Medium·CVSS 4.3 EPSS 0.24%

    The Homey theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the homey_reservation_del() function in all versions up to, and including, 2.4.4. This makes it possible for authenticated attackers, with Subscriber-level access...

21. CVE-2025-1327 Homey - Booking and Rentals WordPress Theme <= 2.4.4 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary User Deletion

    Published 2025-05-02

    Medium·CVSS 4.3 EPSS 0.24%

    The Homey theme for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.4.4 via the 'homey_delete_user_account' action due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subs...

22. CVE-2024-51800 WordPress Homey theme <= 2.4.1 - Privilege Escalation vulnerability

    Published 2025-04-04

    Critical·CVSS 9.8 EPSS 0.46%

    Incorrect Privilege Assignment vulnerability in Favethemes Homey allows Privilege Escalation.This issue affects Homey: from n/a through 2.4.1.

23. CVE-2025-24747 WordPress Houzez theme <= 3.4.0 - Broken Access Control vulnerability

    Published 2025-01-27

    Medium·CVSS 5.3 EPSS 0.27%

    Missing Authorization vulnerability in favethemes Houzez houzez.This issue affects Houzez: from n/a through <= 3.4.0.

24. CVE-2025-24754 WordPress Houzez theme <= 3.4.0 - Broken Access Control vulnerability

    Published 2025-01-27

    Medium·CVSS 4.3 EPSS 0.24%

    Missing Authorization vulnerability in favethemes Houzez houzez.This issue affects Houzez: from n/a through <= 3.4.0.

25. CVE-2024-51888 WordPress Homey Login Register Plugin <= 2.4.0 - Privilege Escalation vulnerability

    Published 2025-01-21

    Critical·CVSS 9.8 EPSS 0.44%

    Incorrect Privilege Assignment vulnerability in favethemes Homey Login Register homey-login-register allows Privilege Escalation.This issue affects Homey Login Register: from n/a through <= 2.4.0.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.