6.1
Moyenne
CVE-2025-9163 The Houzez theme for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up…
Description
The Houzez theme for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 4.1.6 due to insufficient input sanitization and output escaping in the houzez_property_img_upload() and houzez_property_attachment_upload() functions. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Houzez 4.1 | premières → 4.1.6 | Pas de correctif indiqué |
Autres CVE de Houzez
Les 17 CVE de Houzez →
CVE-2025-9191
The Houzez theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.1.6 via…
6.3
Moyenne
CVE-2025-62053
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in…
8.1
Élevée
CVE-2025-49952
Authorization Bypass Through User-Controlled Key vulnerability in favethemes Houzez houzez allows Exploiting Incorrectly…
6.5
Moyenne
CVE-2025-49407
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in favethemes…
8.8
Élevée