An injection flaw exists in the favethemes Houzez Theme - Functionality plugin that allows arbitrary script code to be embedded into generated web pages. The flaw is an example of improper neutralization of input during page rendering (CWE‑79). Exploitation of this vulnerability could enable an attacker to inject client‑side scripts, potentially leading to session hijacking, cookie theft, defacement, or delivery of malicious payloads to site visitors. The impact is confined to web clients and does not provide a direct path to server compromise or data exfiltration on its own.

The vulnerability affects any installation of the WordPress Houzez Theme - Functionality plugin from any version prior to 4.2.0. The plugin is provided by favethemes under the product name Houzez Theme - Functionality.

The vulnerability’s CVSS score of 7.1 places it in the medium‑to‑high severity range. The EPSS score is below 1%, indicating that, as of current data, exploitation rates are low. The flaw is not listed in CISA’s KEV catalog. Likely exploitation would involve a malicious attacker crafting a URL or exploiting a content field to inject script that executes within a victim’s browser when they view the compromised page.