CVE-2026-24355
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2026-01-22

Last updated on: 2026-04-28

Assigner: Patchstack

Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in favethemes Houzez Theme - Functionality houzez-theme-functionality allows Stored XSS.This issue affects Houzez Theme - Functionality: from n/a through <= 4.2.6.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-01-22
Last Modified
2026-04-28
Generated
2026-06-16
AI Q&A
2026-01-22
EPSS Evaluated
2026-06-14
NVD
CVE-2026-24355
EUVD
EUVD-2026-3813
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
favethemes houzez_theme_functionality to 4.2.6 (inc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

CVE-2026-24355 is a Cross Site Scripting (XSS) vulnerability in the WordPress Houzez Theme - Functionality Plugin up to version 4.2.6. It allows a malicious actor to inject and execute malicious scripts such as redirects, advertisements, or other HTML payloads on websites using the affected plugin. Exploitation requires a privileged user (Contributor or Developer role) to interact with malicious content like clicking a link or submitting a form. [1]

Impact Analysis

This vulnerability can lead to the execution of malicious scripts on your website, potentially causing unauthorized redirects, displaying unwanted advertisements, or other harmful actions. However, exploitation requires interaction by a privileged user, which limits the impact. The vulnerability has a moderate severity score of 6.5 but is considered low priority due to these constraints. [1]

Detection Guidance

Detection of this vulnerability involves checking the version of the Houzez Theme - Functionality plugin installed on your WordPress site. You can verify the plugin version via the WordPress admin dashboard or by running commands on the server such as: `wp plugin list` (using WP-CLI) to list installed plugins and their versions. Additionally, monitoring for suspicious script injections or unexpected HTML payloads in pages generated by the plugin may indicate exploitation attempts. There are no specific commands provided for direct detection of the XSS vulnerability itself. [1]

Mitigation Strategies

The immediate mitigation step is to update the Houzez Theme - Functionality plugin to version 4.2.7 or later, where the vulnerability has been fixed. Additionally, restrict privileged user roles (Contributor or Developer) from interacting with untrusted content or links to reduce exploitation risk. Using automated update tools like Patchstack can also help rapidly apply patches and mitigate the vulnerability. [1]

Compliance Impact

The provided resources do not specify how this Cross Site Scripting (XSS) vulnerability in the Houzez Theme - Functionality plugin affects compliance with common standards and regulations such as GDPR or HIPAA.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-24355. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart