Vulnerabilities

Filters

Reset all

1 selected

37 records

Sort

Vendor: favethemes Clear all filters

TI-2026-82495 CVE-2026-61996 · GHSA-3jw6-7g67-2vjx

SQL injection in WordPress MLS On The Fly plugin

LOW 37

Subscriber SQL Injection in MLS On The Fly <= 1.8.1.5 versions.

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.00381 Published 2026-10-29 No fix listed CWE-89

TI-2026-41591 CVE-2026-57768 · GHSA-76p4-jv3p-96f7

WordPress Houzez Login Register plugin <= 3.3.3 - Privilege Escalation vulnerability

MEDIUM 42

Incorrect Privilege Assignment vulnerability in favethemes Houzez Login Register houzez-login-register allows Privilege Escalation.This issue affects Houzez Login Register: from n/a through <= 3.3.3.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.00321 Published 2026-07-13 No fix listed CWE-266

TI-2026-19628 CVE-2026-24355 · GHSA-wfwr-87wr-9c86

WordPress Houzez Theme - Functionality plugin <= 4.2.6 - Cross Site Scripting (XSS) vulnerability

LOW 28

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in favethemes Houzez Theme - Functionality houzez-theme-functionality allows Stored XSS.This issue affects Houzez Theme -…

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00154 Published 2026-01-22 No fix listed CWE-79

TI-2025-41573 CVE-2025-67964 · GHSA-267g-8279-vj63

WordPress Homey Core plugin <= 2.4.3 - Cross Site Scripting (XSS) vulnerability

LOW 31

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in favethemes Homey Core homey-core allows Reflected XSS.This issue affects Homey Core: from n/a through <= 2.4.3.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00291 Published 2026-01-22 No fix listed CWE-79

TI-2025-41574 CVE-2025-67965 · GHSA-8hwj-gjf6-5h2c

WordPress Homey Core plugin <= 2.4.3 - Broken Access Control vulnerability

LOW 30

Missing Authorization vulnerability in favethemes Homey Core homey-core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Homey Core: from n/a through <= 2.4.3.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.0033 Published 2025-12-16 No fix listed CWE-862

TI-2025-08401 CVE-2025-9163 · GHSA-8fg5-7pq6-7pr6

Houzez <= 4.1.6 - Unauthenticated Stored Cross-Site Scripting via SVG File Upload

LOW 27

The Houzez theme for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 4.1.6 due to insufficient input sanitization and output escaping in the houzez_proper…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.0022 Published 2025-11-26 No fix listed CWE-79

TI-2025-08428 CVE-2025-9191 · GHSA-7qhc-892v-5qwh

Houzez <= 4.1.6 - Authenticated (Subscriber+) PHP Object Injection via Saved Search

LOW 28

The Houzez theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.1.6 via deserialization of untrusted input in saved-search-item.php.

CVSS 3.1MEDIUM 6.3 Network Low privileges No interaction EPSS 0.00281 Published 2025-11-26 No fix listed CWE-502

TI-2025-38380 CVE-2025-62057 · GHSA-92vp-r9fc-p4q8

WordPress Houzez Theme - Functionality plugin < 4.2.0 - Cross Site Scripting (XSS) vulnerability

LOW 31

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in favethemes Houzez Theme - Functionality houzez-theme-functionality.This issue affects Houzez Theme - Functionality: fr…

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00244 Published 2025-11-06 No fix listed CWE-79

TI-2025-38376 CVE-2025-62053 · GHSA-mwmx-44g6-hhx9

WordPress Houzez theme < 4.2.0 - Local File Inclusion vulnerability

LOW 38

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in favethemes Houzez houzez.This issue affects Houzez: from n/a through < 4.2.0.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.0043 Published 2025-11-06 No fix listed CWE-98

TI-2025-38381 CVE-2025-62058 · GHSA-2764-97wf-7645

WordPress Houzez Theme - Functionality plugin < 4.2.0 - Cross Site Scripting (XSS) vulnerability

LOW 28

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in favethemes Houzez Theme - Functionality houzez-theme-functionality.This issue affects Houzez Theme - Functionality: fr…

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00176 Published 2025-10-22 No fix listed CWE-79

TI-2025-38377 CVE-2025-62054 · GHSA-qfpj-vmp5-c7g3

WordPress Houzez Theme - Functionality plugin <= 4.1.8 - Local File Inclusion vulnerability

LOW 35

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in favethemes Houzez Theme - Functionality houzez-theme-functionality.This issue affects Houzez Theme…

CVSS 3.1HIGH 7.5 Network Low privileges No interaction EPSS 0.00423 Published 2025-10-22 No fix listed CWE-98

TI-2025-31867 CVE-2025-49952 · GHSA-hgqr-hjhw-98qj

WordPress Houzez theme <= 4.2.5 - Insecure Direct Object References (IDOR) vulnerability

LOW 29

Authorization Bypass Through User-Controlled Key vulnerability in favethemes Houzez houzez allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Houzez: from n/a through <= 4.2.5.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00427 Published 2025-10-22 No fix listed CWE-639

TI-2025-31455 CVE-2025-49407 · GHSA-fqcr-39xg-xrc6

WordPress Houzez Theme <= 4.1.1 - Cross Site Scripting (XSS) Vulnerability

LOW 38

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in favethemes Houzez allows Reflected XSS.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00442 Published 2025-08-28 No fix listed CWE-79

TI-2025-31453 CVE-2025-49405 · GHSA-7ghv-676m-w987

WordPress Houzez Theme < 4.1.4 - Local File Inclusion Vulnerability

LOW 22

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Favethemes Houzez allows PHP Local File Inclusion.This issue affects Houzez: from n/a before 4.1.4.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00268 Published 2025-08-28 Fixed in 4.1.4 CWE-98

TI-2025-31454 CVE-2025-49406 · GHSA-pqjc-6h3w-24vx

WordPress Houzez Theme <= 4.1.1 - Broken Access Control Vulnerability

LOW 37

Missing Authorization vulnerability in favethemes Houzez allows Accessing Functionality Not Properly Constrained by ACLs.

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.00345 Published 2025-08-20 No fix listed CWE-862

TI-2025-33165 CVE-2025-53198 · GHSA-5x27-jcjx-74f6

WordPress Houzez theme <= 4.0.4 - Local File Inclusion Vulnerability

LOW 38

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in favethemes Houzez houzez allows PHP Local File Inclusion.This issue affects Houzez: from n/a throug…

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00659 Published 2025-08-20 No fix listed CWE-98

TI-2025-33843 CVE-2025-53997 · GHSA-rrc2-xq3v-fw2g

WordPress Houzez theme <= 4.0.4 - Broken Access Control Vulnerability

LOW 20

Missing Authorization vulnerability in favethemes Houzez houzez allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Houzez: from n/a through <= 4.0.4.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00283 Published 2025-07-16 No fix listed CWE-862

TI-2025-22307 CVE-2025-31037 · GHSA-83rx-hgq2-g9qf

WordPress Homey theme <= 2.4.5 - Reflected Cross Site Scripting (XSS) vulnerability

LOW 31

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in favethemes Homey homey allows Reflected XSS.This issue affects Homey: from n/a through <= 2.4.5.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.0026 Published 2025-07-04 No fix listed CWE-79

TI-2025-32884 CVE-2025-52834 · GHSA-3j27-hx2r-vv4c

WordPress Homey theme <= 2.4.7 - SQL Injection vulnerability

MEDIUM 46

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in favethemes Homey homey allows SQL Injection.This issue affects Homey: from n/a through <= 2.4.7.

CVSS 3.1CRITICAL 9.3 Network No auth No interaction EPSS 0.00323 Published 2025-06-27 No fix listed CWE-89

TI-2025-01137 CVE-2025-1326 · GHSA-w83h-74w5-cv79

Missing authorization in favethemes Homey

LOW 20

The Homey theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the homey_reservation_del() function in all versions up to, and including, 2.4.4.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00242 Published 2025-05-02 No fix listed CWE-862

TI-2025-01138 CVE-2025-1327 · GHSA-mvp9-jcp7-42x3

Authorization bypass in favethemes Homey

LOW 20

The Homey theme for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.4.4 via the 'homey_delete_user_account' action due to missing validation on a user controlled key.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00242 Published 2025-05-02 No fix listed CWE-639

TI-2024-34704 CVE-2024-51800 · GHSA-22g3-53pr-g6hg

WordPress Homey theme <= 2.4.1 - Privilege Escalation vulnerability

MEDIUM 49

Incorrect Privilege Assignment vulnerability in Favethemes Homey allows Privilege Escalation.This issue affects Homey: from n/a through 2.4.1.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00458 Published 2025-04-04 No fix listed CWE-266

TI-2025-00636 CVE-2025-0748 · GHSA-hjqc-9pmc-98rp

Homey <= 2.4.3 - Cross-Site Request Forgery to User Verification

LOW 19

The Homey theme for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.4.3.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.0017 Published 2025-03-07 No fix listed CWE-352

TI-2025-00637 CVE-2025-0749 · GHSA-vv6r-gfm2-qf53

Homey <= 2.4.3 - Limited Authentication Bypass due to Missing Empty Value Check

LOW 38

The Homey theme for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.4.3.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00525 Published 2025-03-07 No fix listed CWE-288

TI-2024-11088 CVE-2024-11951 · GHSA-9r9q-wj4f-283m

Homey Login Register <= 2.4.0 - Unauthenticated Privilege Escalation in homey_register

MEDIUM 49

The Homey Login Register plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 2.4.0.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00435 Published 2025-03-05 No fix listed CWE-269