{"id":"CVE-2026-96339","kind":"vulnerability","aliases":["CVE-2026-96339"],"related":[],"title":"Houzez WordPress theme: reflected XSS lets attackers run scripts","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Houzez.co Houzez houzez allows Reflected XSS.This issue affects Houzez: from n/a through 4.4.0.","summary":"The Houzez real estate theme for WordPress has a reflected cross-site scripting flaw, affecting versions up to and including 4.4.0. An attacker who gets a victim to open a crafted link can run scripts in the victim's browser session on the site.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"houzez","fixed":["4.4.1"],"affected":"<= 4.4.0","ecosystem":"wordpress-theme"}],"ecosystems":[],"tags":["houzez","package","real-estate-sites","wordpress","wordpress-theme","xss"],"not_affected_if":["houzez-4.4.1-or-later","not-using-houzez"],"how_to_check":"- In WordPress admin go to Appearance > Themes and read the Houzez version, or read the Version line in wp-content/themes/houzez/style.css.\n- Versions 4.4.0 and earlier are affected; 4.4.1 and later are fixed.","fix":"Update the Houzez theme to 4.4.1 or later (and the Houzez CRM plugin, per the vendor changelog quoted on third-party sites).","status":"open","published_at":"2026-10-16T07:17:14+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","triaged_at":"2026-10-25T03:36:45+00:00","updated_at":"2026-10-25T03:48:52+00:00","category":"package","confidence":0.75,"triage":{"at":"2026-10-25T03:36:45Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Houzez WordPress theme: reflected XSS lets attackers run scripts","impact":"medium","summary":"The Houzez real estate theme for WordPress has a reflected cross-site scripting flaw, affecting versions up to and including 4.4.0. An attacker who gets a victim to open a crafted link can run scripts in the victim's browser session on the site.","category":"package","nicknames":[],"who_cares":["wordpress","houzez","real-estate-sites"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Attacker runs scripts in visitors' browsers, stealing sessions or data.","analyst_note":"Find the vendor advisory or patched version for Houzez above 4.4.0 and which input parameter is reflected; the NVD entry gives no fixed version.","how_to_check":"- Check the installed Houzez theme version in the WordPress admin under Appearance > Themes, or in `style.css` of the theme folder.\n- Look for any Houzez version up to `4.4.0`.","needs_analyst":true,"not_affected_if":["not-using-houzez"],"who_is_affected":"Sites running the Houzez WordPress theme at version 4.4.0 or earlier are affected. The sources do not say which page or input is vulnerable, so unknown whether all installs are equally exposed. Sites not using Houzez can skip it.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00059,"input_tokens":3305,"output_tokens":519,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the vendor advisory or patched version for Houzez above 4.4.0 and which input parameter is reflected; the NVD entry gives no fixed version.","search":"'-2026':11A,14A '-96339':12A,15A '4.4.0':49B,99C 'affect':43B,94C 'allow':90C 'attack':7A,51B 'browser':68B 'craft':59B 'cross':39B,82C 'cross-sit':38B,81C 'cve':10A,13A 'estat':21B,31B 'flaw':42B 'generat':80C 'get':53B 'houzez':1A,16A,17B,29B,88C,89C,95C 'houzez.co':87C 'improp':73C 'includ':48B 'input':76C 'issu':93C 'let':6A 'link':60B 'n/a':97C 'neutral':74C 'open':57B 'packag':18B 'page':79C 'real':20B,30B 'real-estate-sit':19B 'reflect':4A,37B,91C 'run':8A,62B 'script':9A,41B,63B,84C 'session':69B 'site':22B,40B,72B,83C 'theme':3A,26B,32B 'version':44B 'victim':55B,66B 'vulner':85C 'web':78C 'wordpress':2A,23B,25B,34B 'wordpress-them':24B 'xss':5A,27B 'xss.this':92C","nicknames":[],"mitigations":[],"who_affected":"Any WordPress site running the Houzez real estate theme at 4.4.0 or earlier is exposed. No login is needed to craft the attack, but a victim must click a crafted link. The vulnerable parameter is not published, so treat all installs as exposed. Sites not using Houzez can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T07:17:14+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-96339","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96339","severity":null,"published_at":"2026-10-16T07:17:14+00:00","modified_at":"2026-10-16T15:19:36+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-96339:798","url":null,"severity":null,"published_at":"2026-10-25T03:48:52+00:00","modified_at":"2026-10-25T03:48:52+00:00","first_seen_at":"2026-10-25T03:48:52+00:00","fetched_at":"2026-10-25T03:48:52+00:00","note":"Patchstack (finder Rafie Muhammad) and CVE record: Houzez <= 4.4.0 affected, fixed 4.4.1. Vulnerable parameter not published by primary sources; a nulled-site changelog mentions dashboard invoice filters but unverified, not used. No vendor page read directly, so nothing marked verified. No exploitation or PoC found."}],"documents":[{"id":3352,"url":"https://patchstack.com/database/wordpress/theme/houzez/vulnerability/wordpress-houzez-theme-4-4-0-cross-site-scripting-xss-vulnerability","title":"Patchstack: Houzez <= 4.4.0 XSS (patched 4.4.1)","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":3353,"url":"https://www.cve.org/CVERecord?id=CVE-2026-96339","title":"CVE record CVE-2026-96339","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}