CVE-2025-9163CWE-79cross-site-scripting

CVE-2025-9163

Medium · published November 26, 2025

CVSS v3.1

6.1

EPSS

Percentile

10.0

In the wild

Unconfirmed

What it is

The Houzez theme for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 4.1.6 due to insufficient input sanitization and output escaping in the houzez_property_img_upload() and houzez_property_attachment_upload() functions. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.

The record

Technical detail

CVSS v3.1: 6.1 · MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0: Not supplied
EPSS: 0.00205 · 10.0th percentile
Weakness: CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published: 2025-11-26T18:16Z

References (2)

https://favethemes.zendesk.com/hc/en-us/articles/360041639432-Changelog · [email protected]https://www.wordfence.com/threat-intel/vulnerabilities/id/e0e177f3-fb24-4dd5-80d5-19b113d5f527?source=cve · [email protected]

EPSS history

Timeline

26 NOV 12:30Z
Houzez <= 4.1.6 - Unauthenticated Stored Cross-Site Scripting via SVG File Upload
cvelistv5