CVE-2026-96339
7.1HighPublished 16 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
- Impact
- Limited impact
- Weakness
- CWE-79
Impact
Remote attackers can execute arbitrary JavaScript in a victim's browser session to steal credentials or hijack accounts. They need an unauthenticated user to click a specially crafted malicious link.
Root cause
The theme fails to sanitize user-supplied input before reflecting it back into generated web pages.
Affected systems
Houzez theme versions up to and including 4.4.0
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Fix & remediation
Upgrade the Houzez theme to a version newer than 4.4.0 when available. If patching must wait, block suspicious query strings or disable the theme on exposed WordPress instances.
$ wp theme status houzezAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Houzez.co Houzez houzez allows Reflected XSS.This issue affects Houzez: from n/a through 4.4.0.