The Houzez Theme - Functionality plugin for WordPress contains an improper neutralization of input during web page generation vulnerability (CWE‑79). The flaw allows injection of arbitrary JavaScript when user‑supplied data is rendered without adequate sanitization, enabling code to run in visitors' browsers.

WordPress sites that use the Houzez Theme‑Functionality plugin from any earlier version through pre‑4.2.0 are affected; all installations running a version older than 4.2.0 are vulnerable.

The CVSS base score of 6.5 classifies the flaw as medium severity. The EPSS score suggests exploitation likelihood is less than 1 percent, indicating low probability of widespread attacks. It is not listed in the CISA KEV catalog. The attack vector is likely through any page input or form processed by the plugin, and the vulnerability can be triggered without user authentication, meaning a visitor could potentially exploit it.