CVEs we hold for Favethemes

Records whose assigning authority named Favethemes as the affected vendor. Newest identifiers first, capped at 200.

CVE-2026-57768WordPress Houzez Login Register plugin <= 3.3.3 - Privilege Escalation vulnerabilityfavethemes Houzez Login Register

CVE-2026-24355WordPress Houzez Theme - Functionality plugin <= 4.2.6 - Cross Site Scripting (XSS) vulnerabilityfavethemes Houzez Theme - Functionality

CVE-2025-9191Houzez <= 4.1.6 - Authenticated (Subscriber+) PHP Object Injection via Saved Searchfavethemes Houzez

CVE-2025-9163Houzez <= 4.1.6 - Unauthenticated Stored Cross-Site Scripting via SVG File Uploadfavethemes Houzez

CVE-2025-67965WordPress Homey Core plugin <= 2.4.3 - Broken Access Control vulnerabilityfavethemes Homey Core

CVE-2025-67964WordPress Homey Core plugin <= 2.4.3 - Cross Site Scripting (XSS) vulnerabilityfavethemes Homey Core

CVE-2025-62058WordPress Houzez Theme - Functionality plugin < 4.2.0 - Cross Site Scripting (XSS) vulnerabilityfavethemes Houzez Theme - Functionality

CVE-2025-62057WordPress Houzez Theme - Functionality plugin < 4.2.0 - Cross Site Scripting (XSS) vulnerabilityfavethemes Houzez Theme - Functionality

CVE-2025-62054WordPress Houzez Theme - Functionality plugin <= 4.1.8 - Local File Inclusion vulnerabilityfavethemes Houzez Theme - Functionality

CVE-2025-62053WordPress Houzez theme < 4.2.0 - Local File Inclusion vulnerabilityfavethemes Houzez

CVE-2025-53997WordPress Houzez theme <= 4.0.4 - Broken Access Control Vulnerabilityfavethemes Houzez

CVE-2025-53198WordPress Houzez theme <= 4.0.4 - Local File Inclusion Vulnerabilityfavethemes Houzez

CVE-2025-52834WordPress Homey theme <= 2.4.7 - SQL Injection vulnerabilityfavethemes Homey

CVE-2025-49952WordPress Houzez theme <= 4.2.5 - Insecure Direct Object References (IDOR) vulnerabilityfavethemes Houzez

CVE-2025-49407WordPress Houzez Theme <= 4.1.1 - Cross Site Scripting (XSS) Vulnerabilityfavethemes Houzez

CVE-2025-49406WordPress Houzez Theme <= 4.1.1 - Broken Access Control Vulnerabilityfavethemes Houzez

CVE-2025-49405WordPress Houzez Theme < 4.1.4 - Local File Inclusion VulnerabilityFavethemes Houzez

CVE-2025-31037WordPress Homey theme <= 2.4.5 - Reflected Cross Site Scripting (XSS) vulnerabilityfavethemes Homey

CVE-2025-24754WordPress Houzez theme <= 3.4.0 - Broken Access Control vulnerabilityfavethemes Houzez

CVE-2025-24747WordPress Houzez theme <= 3.4.0 - Broken Access Control vulnerabilityfavethemes Houzez

CVE-2024-5793Houzez Theme - Functionality <= 3.2.2 - Authenticated (Seller+) SQL InjectionFavethemes Houzez Theme - Functionality

CVE-2024-51888WordPress Homey Login Register Plugin <= 2.4.0 - Privilege Escalation vulnerabilityfavethemes Homey Login Register

CVE-2024-51800WordPress Homey theme <= 2.4.1 - Privilege Escalation vulnerabilityFavethemes Homey

CVE-2024-43244WordPress houzez Theme By FaveThemes <= 3.2.4 - Cross Site Scripting (XSS) vulnerabilityfavethemes Houzez

CVE-2024-22303WordPress Houzez theme <= 3.2.4 - Privilege Escalation vulnerabilityfavethemes Houzez

CVE-2024-21743WordPress Houzez Login Register plugin <= 3.2.5 - Privilege Escalation vulnerabilityfavethemes Houzez Login Register

CVE-2023-36529WordPress Houzez CRM Plugin <= 1.3.4 is vulnerable to SQL InjectionFavethemes Houzez - Real Estate WordPress Theme

CVE-2023-29432WordPress Houzez Theme < 2.8.3 is vulnerable to SQL InjectionFavethemes Houzez - Real Estate WordPress Theme

CVE-2023-26540WordPress Houzez theme <= 2.7.1 - Privilege EscalationFavethemes Houzez

CVE-2023-26009WordPress Houzez Login Register plugin <= 2.6.3 - Privilege EscalationFavethemes Houzez Login Register

30 records, read from the index as it stood on 20 Sep 2026. Every row opens the record it names, and every value on that record opens its own receipt.

Everything on this page is free. Public data. Withholding it protects nothing.