Stored Cross-Site Scripting in Houzez Theme for WordPress

CVE-2025-9163

What is CVE-2025-9163?

The Houzez theme for WordPress has a significant vulnerability allowing stored Cross-Site Scripting (XSS) due to inadequate input validation and output encoding mechanisms during SVG file uploads. This flaw affects all versions of the theme up to and including 4.1.6. As a result, unauthenticated attackers could exploit this vulnerability to embed malicious scripts within uploaded SVG files. When users later access these files, their browsers will execute the harmful scripts, potentially leading to unauthorized actions and data exposure.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References