Live › vulnerability › CVE-2026-96339
Go to dashboardThe Houzez real estate theme for WordPress has a reflected cross-site scripting flaw, affecting versions up to and including 4.4.0. An attacker who gets a victim to open a crafted link can run scripts in the victim's browser session on the site.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Any WordPress site running the Houzez real estate theme at 4.4.0 or earlier is exposed. No login is needed to craft the attack, but a victim must click a crafted link. The vulnerable parameter is not published, so treat all installs as exposed. Sites not using Houzez can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| houzez | wordpress-theme | <= 4.4.0 | 4.4.1 |
Update the Houzez theme to 4.4.1 or later (and the Houzez CRM plugin, per the vendor changelog quoted on third-party sites).
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Houzez.co Houzez houzez allows Reflected XSS.This issue affects Houzez: from n/a through 4.4.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-96339")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.