CVE-2026-96339
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Houzez.co Houzez allows Reflected XSS. This issue affects Houzez: from n/a through 4.4.0.
Risk Assessment
An attacker can execute arbitrary JavaScript in a victim's browser, potentially leading to session data theft or other actions. This can lead to user account takeover.
Recommendation
Update the Houzez plugin to a version later than 4.4.0. Until then, consider implementing input filtering or a WAF.
Other vulnerabilities in Houzez
See all- CVE-2025-9191Medium
The Houzez theme for WordPress is vulnerable to PHP Object Injection in all versions up to and including 4.1.6 via deserialization of untrusted input in saved-search-item.php. This allows authenticated attackers with Subscriber-level access and above to inject a PHP Object. No known POP chain is present in the vulnerable software, meaning this vulnerability has no impact unless another plugin or theme containing a POP chain is installed. If a POP chain is present, it may allow the attacker to perform actions like deleting arbitrary files, retrieving sensitive data, or executing code.
- CVE-2025-49952Medium
An authorization bypass through a user-controlled key vulnerability in the favethemes Houzez plugin allows exploitation of incorrectly configured access control security levels. This issue affects Houzez versions up to and including 4.2.5.
- CVE-2025-49405Medium
The Houzez theme for WordPress is vulnerable to PHP Local File Inclusion due to improper control of filenames in include/require statements. This affects versions before 4.1.4.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Houzez.co Houzez houzez allows Reflected XSS.This issue affects Houzez: from n/a through 4.4.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS