Stored Cross-Site Scripting in Houzez Theme for WordPress

CVE-2025-9163

What is CVE-2025-9163?

The Houzez theme for WordPress has a significant vulnerability allowing stored Cross-Site Scripting (XSS) due to inadequate input validation and output encoding mechanisms during SVG file uploads. This flaw affects all versions of the theme up to and including 4.1.6. As a result, unauthenticated attackers could exploit this vulnerability to embed malicious scripts within uploaded SVG files. When users later access these files, their browsers will execute the harmful scripts, potentially leading to unauthorized actions and data exposure.

References