# cve.now: Favethemes

The newest entries naming Favethemes as an affected vendor (up to 200), of 31 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-61996](https://cve.now/CVE-2026-61996.md): WordPress MLS On The Fly plugin \<= 1.8.1.5 - SQL Injection vulnerability (CVSS 8.5)
- [CVE-2026-57768](https://cve.now/CVE-2026-57768.md): WordPress Houzez Login Register plugin \<= 3.3.3 - Privilege Escalation vulnerability (CVSS 8.2)
- [CVE-2026-24355](https://cve.now/CVE-2026-24355.md): WordPress Houzez Theme - Functionality plugin \<= 4.2.6 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2025-67964](https://cve.now/CVE-2025-67964.md): WordPress Homey Core plugin \<= 2.4.3 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2025-67965](https://cve.now/CVE-2025-67965.md): WordPress Homey Core plugin \<= 2.4.3 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2025-9163](https://cve.now/CVE-2025-9163.md): Houzez \<= 4.1.6 - Unauthenticated Stored Cross-Site Scripting via SVG File Upload (CVSS 6.1)
- [CVE-2025-9191](https://cve.now/CVE-2025-9191.md): Houzez \<= 4.1.6 - Authenticated (Subscriber+) PHP Object Injection via Saved Search (CVSS 6.3)
- [CVE-2025-62057](https://cve.now/CVE-2025-62057.md): WordPress Houzez Theme - Functionality plugin \< 4.2.0 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2025-62053](https://cve.now/CVE-2025-62053.md): WordPress Houzez theme \< 4.2.0 - Local File Inclusion vulnerability (CVSS 8.1)
- [CVE-2025-62058](https://cve.now/CVE-2025-62058.md): WordPress Houzez Theme - Functionality plugin \< 4.2.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2025-62054](https://cve.now/CVE-2025-62054.md): WordPress Houzez Theme - Functionality plugin \<= 4.1.8 - Local File Inclusion vulnerability (CVSS 7.5)
- [CVE-2025-49952](https://cve.now/CVE-2025-49952.md): WordPress Houzez theme \<= 4.2.5 - Insecure Direct Object References (IDOR) vulnerability (CVSS 6.5)
- [CVE-2025-49407](https://cve.now/CVE-2025-49407.md): WordPress Houzez Theme \<= 4.1.1 - Cross Site Scripting (XSS) Vulnerability (CVSS 8.8)
- [CVE-2025-49405](https://cve.now/CVE-2025-49405.md): WordPress Houzez Theme \< 4.1.4 - Local File Inclusion Vulnerability (CVSS 4.3)
- [CVE-2025-49406](https://cve.now/CVE-2025-49406.md): WordPress Houzez Theme \<= 4.1.1 - Broken Access Control Vulnerability (CVSS 8.5)
- [CVE-2025-53198](https://cve.now/CVE-2025-53198.md): WordPress Houzez theme \<= 4.0.4 - Local File Inclusion Vulnerability (CVSS 8.1)
- [CVE-2025-53997](https://cve.now/CVE-2025-53997.md): WordPress Houzez theme \<= 4.0.4 - Broken Access Control Vulnerability (CVSS 4.3)
- [CVE-2025-31037](https://cve.now/CVE-2025-31037.md): WordPress Homey theme \<= 2.4.5 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2025-52834](https://cve.now/CVE-2025-52834.md): WordPress Homey theme \<= 2.4.7 - SQL Injection vulnerability (CVSS 9.3)
- [CVE-2024-51800](https://cve.now/CVE-2024-51800.md): WordPress Homey theme \<= 2.4.1 - Privilege Escalation vulnerability (CVSS 9.8)
- [CVE-2025-24747](https://cve.now/CVE-2025-24747.md): WordPress Houzez theme \<= 3.4.0 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2025-24754](https://cve.now/CVE-2025-24754.md): WordPress Houzez theme \<= 3.4.0 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2024-51888](https://cve.now/CVE-2024-51888.md): WordPress Homey Login Register Plugin \<= 2.4.0 - Privilege Escalation vulnerability (CVSS 9.8)
- [CVE-2024-22303](https://cve.now/CVE-2024-22303.md): WordPress Houzez theme \<= 3.2.4 - Privilege Escalation vulnerability (CVSS 8.8)
- [CVE-2024-21743](https://cve.now/CVE-2024-21743.md): WordPress Houzez Login Register plugin \<= 3.2.5 - Privilege Escalation vulnerability (CVSS 8.8)
- [CVE-2024-43244](https://cve.now/CVE-2024-43244.md): WordPress houzez Theme By FaveThemes \<= 3.2.4 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2024-5793](https://cve.now/CVE-2024-5793.md): Houzez Theme - Functionality \<= 3.2.2 - Authenticated (Seller+) SQL Injection (CVSS 8.8)
- [CVE-2023-26540](https://cve.now/CVE-2023-26540.md): WordPress Houzez theme \<= 2.7.1 - Privilege Escalation (CVSS 9.8)
- [CVE-2023-26009](https://cve.now/CVE-2023-26009.md): WordPress Houzez Login Register plugin \<= 2.6.3 - Privilege Escalation (CVSS 9.8)
- [CVE-2023-29432](https://cve.now/CVE-2023-29432.md): WordPress Houzez Theme \< 2.8.3 is vulnerable to SQL Injection (CVSS 8.2)
- [CVE-2023-36529](https://cve.now/CVE-2023-36529.md): WordPress Houzez CRM Plugin \<= 1.3.4 is vulnerable to SQL Injection (CVSS 9.9)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/favethemes
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.