Houzez

Houzez has 16 disclosed vulnerabilities in the WordSec catalog, reported between 2020 and 2025; 15 are fixed and 1 remains unpatched as of September 2026. Their average CVSS score is 6.7, and the most serious one scores 9.8 out of 10. Severity breakdown: 2 critical and 4 high. 2025 was the busiest year with 11 disclosures.

The most common weakness is Cross-Site Scripting, behind 4 of the records (25%). Other recurring categories include Missing Authorization, PHP Remote File Inclusion.

15 of the records (94%) have a vendor fix, while 1 remain unpatched. The oldest unresolved one dates back to 2025.

9 independent researchers contributed these findings, most of them (3) reported by Rafie Muhammad.

Strategic Overview

Avg CVSSMedium

6.7/ 10

Patch Coverage94%

Open

Fixed

Get automatic notifications for all Houzez vulnerabilities before they are exploited.

Most severe open issueCVSS 4.3CVE-2025-49952

Houzez <= 4.1.1 - Authenticated (Subscriber+) Insecure Direct Object Reference

Read the full analysis

Vulnerability Records

16 records


2025-11-26 00:01	Houzez <= 4.1.6 - Authenticated (Subscriber+) PHP Object Injection via Saved Search Houzez <= 4.1.6	`CVE-2025-9191`	6.3 Medium	Alex Thomas	Yes
2025-11-26 00:01	Houzez <= 4.1.6 - Unauthenticated Stored Cross-Site Scripting via SVG File Upload Houzez <= 4.1.6	`CVE-2025-9163`	6.1 Medium	Alex Thomas	Yes
2025-10-16 00:00	Houzez < 4.2.0 - Unauthenticated Local File Inclusion Houzez < 4.2.0	`CVE-2025-62053`	8.1 High	João Pedro Soares de Alcântara	Yes
2025-08-27 00:00	Houzez <= 4.1.1 - Reflected Cross-Site Scripting Houzez <= 4.1.1	`CVE-2025-49407`	6.1 Medium	Rafie Muhammad	Yes
2025-08-27 00:00	Houzez <= 4.1.1 - Unauthenticated Local File Inclusion Houzez <= 4.1.1	`CVE-2025-49405`	8.1 High	Rafie Muhammad	Yes
2025-08-20 00:00	Houzez <= 4.1.1 - Missing Authorization Houzez <= 4.1.1	`CVE-2025-49406`	5.3 Medium	Rafie Muhammad	Yes
2025-07-16 00:00	Houzez <= 4.0.4 - Missing Authorization Houzez <= 4.0.4	`CVE-2025-53997`	4.3 Medium	Tran Nguyen Bao Khanh	Yes
2025-07-11 00:00	Houzez <= 4.1.1 - Authenticated (Subscriber+) Insecure Direct Object Reference Houzez <= 4.1.1	`CVE-2025-49952`	4.3 Medium	Tran Nguyen Bao Khanh	No
2025-07-01 00:00	Houzez <= 4.0.4 - Unauthenticated Local File Inclusion Houzez <= 4.0.4	`CVE-2025-53198`	8.1 High	Tran Nguyen Bao Khanh	Yes
2025-01-24 00:00	Houzez <= 3.4.0 - Missing Authorization Houzez <= 3.4.0	`CVE-2025-24754`	4.3 Medium	Ananda Dhakal	Yes

Showing 1–10 of 16 reports