CVE-2026-96339: WordPress Houzez theme <= 4.4.0 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Houzez.co Houzez houzez allows Reflected XSS.This issue affects Houzez: from n/a through 4.4.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Houzez themeto a version that resolves this vulnerability.Fixed in 4.4.1
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The attack can be conducted over the network without authentication, but it requires user interaction. An attacker would need to cause a user to access a crafted request or page that triggers the reflected XSS payload.
Are sites using the default theme configuration affected?
The available information does not identify any configuration prerequisite. The issue is reported as affecting Houzez versions through 4.4.0.
How can I determine whether my site is affected?
Check the installed Houzez theme version. Versions up to and including 4.4.0 are within the reported affected range.
What is the potential impact if exploitation succeeds?
Successful exploitation can affect confidentiality, integrity, and availability at low impact, with scope changed. Because this is reflected XSS, impact depends on a user interacting with attacker-controlled content.