Favethemes vulnerabilities

Products

• Houzez 20
• Homey 8
• Houzez Theme - Functionality 5
• Houzez Login Register 3
• Homey Core 2
• Houzez - Real Estate Wordpress Theme 2

Newest

• favethemes mls on the fly WordPress MLS On The Fly plugin <= 1.8.1.5 - SQL Injection vulnerability CVE-2026-61996 8.5 HighOctober 29, 2026
• favethemes houzez WordPress Houzez theme <= 4.4.0 - Cross Site Scripting (XSS) vulnerability CVE-2026-96339 7.1 HighOctober 16, 2026
• favethemes houzez login register WordPress Houzez Login Register plugin <= 3.3.3 - Privilege Escalation vulnerability CVE-2026-57768 8.2 HighJuly 13, 2026
• favethemes houzez theme - functionality WordPress Houzez Theme - Functionality plugin <= 4.2.6 - Cross Site Scripting (XSS) vulnerability CVE-2026-24355 6.5 MediumJanuary 22, 2026
• favethemes homey core WordPress Homey Core plugin <= 2.4.3 - Cross Site Scripting (XSS) vulnerability CVE-2025-67964 7.1 HighJanuary 22, 2026
• favethemes homey core WordPress Homey Core plugin <= 2.4.3 - Broken Access Control vulnerability CVE-2025-67965 5.3 MediumDecember 16, 2025
• favethemes houzez Houzez <= 4.1.6 - Unauthenticated Stored Cross-Site Scripting via SVG File Upload CVE-2025-9163 6.1 MediumNovember 26, 2025
• favethemes houzez Houzez <= 4.1.6 - Authenticated (Subscriber+) PHP Object Injection via Saved Search CVE-2025-9191 6.3 MediumNovember 26, 2025
• favethemes houzez theme - functionality WordPress Houzez Theme - Functionality plugin < 4.2.0 - Cross Site Scripting (XSS) vulnerability CVE-2025-62057 7.1 HighNovember 6, 2025
• favethemes houzez WordPress Houzez theme < 4.2.0 - Local File Inclusion vulnerability CVE-2025-62053 8.1 HighNovember 6, 2025
• favethemes houzez theme - functionality WordPress Houzez Theme - Functionality plugin < 4.2.0 - Cross Site Scripting (XSS) vulnerability CVE-2025-62058 6.5 MediumOctober 22, 2025
• favethemes houzez theme - functionality WordPress Houzez Theme - Functionality plugin <= 4.1.8 - Local File Inclusion vulnerability CVE-2025-62054 7.5 HighOctober 22, 2025
• favethemes houzez WordPress Houzez theme <= 4.2.5 - Insecure Direct Object References (IDOR) vulnerability CVE-2025-49952 6.5 MediumOctober 22, 2025
• favethemes houzez WordPress Houzez Theme <= 4.1.1 - Cross Site Scripting (XSS) Vulnerability CVE-2025-49407 8.8 HighAugust 28, 2025
• favethemes houzez WordPress Houzez Theme < 4.1.4 - Local File Inclusion Vulnerability CVE-2025-49405 4.3 MediumAugust 28, 2025
• favethemes houzez WordPress Houzez Theme <= 4.1.1 - Broken Access Control Vulnerability CVE-2025-49406 8.5 HighAugust 20, 2025
• favethemes houzez WordPress Houzez theme <= 4.0.4 - Local File Inclusion Vulnerability CVE-2025-53198 8.1 HighAugust 20, 2025
• favethemes houzez WordPress Houzez theme <= 4.0.4 - Broken Access Control Vulnerability CVE-2025-53997 4.3 MediumJuly 16, 2025
• favethemes homey WordPress Homey theme <= 2.4.5 - Reflected Cross Site Scripting (XSS) vulnerability CVE-2025-31037 7.1 HighJuly 4, 2025
• favethemes homey WordPress Homey theme <= 2.4.7 - SQL Injection vulnerability CVE-2025-52834 9.3 CriticalJune 27, 2025
• fave themes homey Homey - Booking and Rentals WordPress Theme <= 2.4.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Reservation & Post Deletion CVE-2025-1326 4.3 MediumMay 2, 2025
• fave themes homey Homey - Booking and Rentals WordPress Theme <= 2.4.4 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary User Deletion CVE-2025-1327 4.3 MediumMay 2, 2025
• favethemes homey WordPress Homey theme <= 2.4.1 - Privilege Escalation vulnerability CVE-2024-51800 9.8 CriticalApril 4, 2025
• fave themes homey Homey <= 2.4.3 - Cross-Site Request Forgery to User Verification CVE-2025-0748 4.3 MediumMarch 7, 2025
• fave themes homey Homey <= 2.4.3 - Limited Authentication Bypass due to Missing Empty Value Check CVE-2025-0749 8.1 HighMarch 7, 2025
• fave themes homey Homey <= 2.4.2 - Unauthenticated Privilege Escalation in homey_save_profile CVE-2024-12281 9.8 CriticalMarch 5, 2025
• favethemes houzez WordPress Houzez theme <= 3.4.0 - Broken Access Control vulnerability CVE-2025-24747 5.3 MediumJanuary 27, 2025
• favethemes houzez WordPress Houzez theme <= 3.4.0 - Broken Access Control vulnerability CVE-2025-24754 4.3 MediumJanuary 27, 2025
• fave themes homey login register WordPress Homey Login Register Plugin <= 2.4.0 - Privilege Escalation vulnerability CVE-2024-51888 9.8 CriticalJanuary 21, 2025
• favethemes houzez WordPress Houzez theme <= 3.2.4 - Privilege Escalation vulnerability CVE-2024-22303 8.8 HighSeptember 17, 2024
• favethemes houzez, houzez login register +1 more WordPress Houzez Login Register plugin <= 3.2.5 - Privilege Escalation vulnerability CVE-2024-21743 8.8 HighSeptember 17, 2024
• favethemes houzez WordPress houzez Theme By FaveThemes <= 3.2.4 - Cross Site Scripting (XSS) vulnerability CVE-2024-43244 7.1 HighAugust 18, 2024
• favethemes houzez crm, houzez crm +1 more Houzez CRM <= 1.4.2 - Authenticated (Seller+) SQL Injection CVE-2024-5792 8.8 HighJuly 10, 2024
• favethemes houzez, houzez theme - functionality +1 more Houzez Theme - Functionality <= 3.2.2 - Authenticated (Seller+) SQL Injection CVE-2024-5793 8.8 HighJuly 9, 2024
• favethemes houzez WordPress Houzez theme <= 2.7.1 - Privilege Escalation CVE-2023-26540 9.8 CriticalMay 17, 2024
• favethemes houzez, houzez login register +1 more WordPress Houzez Login Register plugin <= 2.6.3 - Privilege Escalation CVE-2023-26009 9.8 CriticalMay 17, 2024
• favethemes houzez, houzez - real estate wordpress theme +1 more WordPress Houzez Theme < 2.8.3 is vulnerable to SQL Injection CVE-2023-29432 8.2 HighDecember 20, 2023
• favethemes houzez, houzez - real estate wordpress theme +1 more WordPress Houzez CRM Plugin <= 1.3.4 is vulnerable to SQL Injection CVE-2023-36529 9.9 CriticalNovember 3, 2023