CVE-2025-9191
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
The Houzez theme for WordPress is vulnerable to PHP Object Injection in all versions up to and including 4.1.6 via deserialization of untrusted input in saved-search-item.php. This allows authenticated attackers with Subscriber-level access and above to inject a PHP Object. No known POP chain is present in the vulnerable software, meaning this vulnerability has no impact unless another plugin or theme containing a POP chain is installed. If a POP chain is present, it may allow the attacker to perform actions like deleting arbitrary files, retrieving sensitive data, or executing code.
Risk Assessment
If a POP chain is present, an attacker could delete files, access sensitive data, or execute code, potentially leading to a serious security breach.
Recommendation
Update the Houzez theme to a version later than 4.1.6.
Other vulnerabilities in Houzez
See all- CVE-2026-96339High
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Houzez.co Houzez allows Reflected XSS. This issue affects Houzez: from n/a through 4.4.0.
- CVE-2025-49952Medium
An authorization bypass through a user-controlled key vulnerability in the favethemes Houzez plugin allows exploitation of incorrectly configured access control security levels. This issue affects Houzez versions up to and including 4.2.5.
- CVE-2025-49405Medium
The Houzez theme for WordPress is vulnerable to PHP Local File Inclusion due to improper control of filenames in include/require statements. This affects versions before 4.1.4.
Original NVD description (English source)
The Houzez theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.1.6 via deserialization of untrusted input in saved-search-item.php. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS