Technical impact
The Houzez WordPress theme contains a stored cross‑site scripting vulnerability that allows unauthenticated users to upload SVG files containing malicious JavaScript. When an attacker uploads such a file, the scripting code is stored and executed in the browser whenever the SVG is viewed, potentially enabling session hijacking, defacement or malicious redirect of site visitors. This flaw is caused by insufficient input sanitization and output escaping in the theme’s file‑upload functions, classified as CWE‑79.
Affected Systems
The vulnerability affects sites running the Houzez theme for WordPress version 4.1.6 and earlier. The theme is distributed by favethemes under the product name Houzez. The specific functions responsible for the flaw are houzez_property_img_upload() and houzez_property_attachment_upload(). No other vendors or products are listed as affected. If a site is using any of these versions, it is at risk.
Risk and Exploitability
The CVSS score is 6.1 indicating a moderate level of impact. The EPSS score is less than 1%, suggesting that exploitation likelihood is low at present. The vulnerability is not listed in the CISA KEV catalog. Attackers do not need any user credentials; they simply need access to the file‑upload interface for a website using the affected theme. Once an SVG file is uploaded, the malicious script will run in the browsers of any user who opens that file, which can provide an attacker with significant avenues for credential theft or defacement. Because the flaw permits arbitrary script execution, it is highly dangerous in a trusted site environment.
