← WordPress Vulnerabilities
WordPress security by component

Houzez

Houzez is a WordPress component with 15 published CVE records in this archive. The latest tracked vulnerability was published Nov 26, 2025; the highest CVE/CNA score is 9.8.

Theme slug: houzez

CVE-2025-9191: Houzez: Code execution

Houzez is affected by code execution. Exploitation requires at least subscriber-level access. Successful exploitation can run attacker-controlled code in the WordPress hosting account.

PublishedNov 26, 2025
Safe version guidanceSee mitigation notes
Safe version
Nov 26, 2025 CVE-2025-9191
Houzez: Code execution
Houzez is affected by code execution. Exploitation requires at least subscriber-level access. Successful exploitation can run attacker-controlled code in the WordPress hosting account.
See mitigation notes
CVE6.3
NVDPending
Nov 26, 2025 CVE-2025-9163
Houzez: Cross-site scripting
Houzez is affected by cross-site scripting. The vulnerable path is reachable without authentication. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
See mitigation notes
CVE6.1
NVDPending
Nov 06, 2025 CVE-2025-62053
Houzez: A security weakness
Houzez is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.
See mitigation notes
CVE8.1
NVDPending
Oct 22, 2025 CVE-2025-49952
Houzez: A security weakness
Houzez is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.
See mitigation notes
CVE6.5
NVDPending
Aug 28, 2025 CVE-2025-49407
Houzez: Cross-site scripting
Houzez is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
See mitigation notes
CVE8.8
NVDPending
Aug 28, 2025 CVE-2025-49405
Houzez: Filesystem traversal
Houzez is affected by filesystem traversal. Exposure depends on how the affected operation is made reachable by the site. A crafted path can escape the intended directory and reach files or directories elsewhere on the server.
See mitigation notes
CVE4.3
NVDPending
Aug 20, 2025 CVE-2025-53198
Houzez: Filesystem traversal
Houzez is affected by filesystem traversal. Exposure depends on how the affected operation is made reachable by the site. A crafted path can escape the intended directory and reach files or directories elsewhere on the server.
See mitigation notes
CVE8.1
NVDPending
Aug 20, 2025 CVE-2025-49406
Houzez: A security weakness
Houzez is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.
See mitigation notes
CVE8.5
NVDPending
Jul 16, 2025 CVE-2025-53997
Houzez: A security weakness
Houzez is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.
See mitigation notes
CVE4.3
NVDPending
Jan 27, 2025 CVE-2025-24747
Houzez: A security weakness
Houzez is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.
See mitigation notes
CVE5.3
NVDPending
Jan 27, 2025 CVE-2025-24754
Houzez: A security weakness
Houzez is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.
See mitigation notes
CVE4.3
NVDPending
Sep 17, 2024 CVE-2024-22303
Houzez: Privilege escalation or authentication bypass
Houzez is affected by privilege escalation or authentication bypass. Exposure depends on how the affected operation is made reachable by the site. A successful request can grant permissions or access that the caller should not possess.
See mitigation notes
CVE8.8
NVDPending
Aug 18, 2024 CVE-2024-43244
Houzez: Cross-site scripting
Houzez is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
See mitigation notes
CVE7.1
NVDPending
May 17, 2024 CVE-2023-26540
Houzez: Privilege escalation or authentication bypass
Houzez is affected by privilege escalation or authentication bypass. Exposure depends on how the affected operation is made reachable by the site. A successful request can grant permissions or access that the caller should not possess.
See mitigation notes
CVE9.8
NVDPending
Dec 20, 2023 CVE-2023-29432
Houzez - Real Estate WordPress Theme: SQL injection
Houzez - Real Estate WordPress Theme is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data.
See mitigation notes
CVE8.2
NVD9.8