| Plugin Name | Houzez |
|---|---|
| Type of Vulnerability | Cross-Site Scripting (XSS) |
| CVE Number | CVE-2025-9163 |
| Urgency | Medium |
| CVE Publish Date | 2025-11-27 |
| Source URL | CVE-2025-9163 |
Houzez Theme Unauthenticated Stored XSS (CVE-2025-9163): What it Means and How to Protect Your WordPress Site
This advisory summarises an unauthenticated stored cross-site scripting (XSS) vulnerability discovered in the Houzez WordPress theme (versions ≤ 4.1.6). The issue allows an unauthenticated attacker to upload or store crafted SVG files that contain scriptable content. A patch is available in Houzez 4.1.7. This note adopts a pragmatic Hong Kong security expert tone: clear, direct and focused on actionable detection, mitigation and recovery steps for site owners and administrators.
Executive summary
- Vulnerability: Unauthenticated stored XSS via SVG file upload in Houzez (≤ 4.1.6).
- Severity: Medium (public reporting context assigns CVSS ~7.1; real impact depends on site configuration and rendering context).
- Affected versions: Houzez ≤ 4.1.6.
- Fixed in: Houzez 4.1.7 — update promptly.
- Immediate risk: An unauthenticated attacker can store an SVG that executes script in visitors’ browsers when rendered, potentially impacting administrators and visitors.
- Short-term mitigations: Disable SVG uploads, restrict upload capabilities, sanitize existing SVGs, and apply edge filtering or WAF rules to block suspicious uploads.
- Long-term: Patch the theme, enforce least privilege on uploads, serve untrusted media from separate origins, and adopt strict HTTP security headers including a robust CSP.
Why SVG uploads are risky
SVG (Scalable Vector Graphics) is an XML-based, text format. Unlike raster images (JPG, PNG), SVG can include embedded JavaScript, event handlers and external resource references. If an SVG is embedded in a page in a way that allows its script to run, it becomes an attack vector for stored XSS.
Typical pitfalls:
- Many WordPress sites accept media uploads via the Media Library or custom forms. Weak server-side validation lets attackers drop crafted SVGs at predictable URLs.
- SVGs rendered inline or embedded via elements can execute when the page loads. Examples of embedding include
,or inserting SVG markup directly into the DOM. - Uploaders that only check file extensions or perform client-side checks can be bypassed (e.g., renaming files or tampering with headers).
Because this issue is unauthenticated, an attacker only needs the vulnerable upload endpoint to store a malicious SVG.
What “stored XSS” means here
Stored XSS means a malicious payload is persisted on the server and later served to victims as part of normal content. In Houzez, an attacker can upload an SVG containing script; when a page references that file and the browser executes the script, the code runs within the site’s origin. Consequences include:
- Session theft and account takeover (if cookies or tokens are accessible).
- Privileged actions executed via an admin’s browser (e.g., changing settings, creating accounts).
- Content injection (defacement, malicious redirects, SEO spam).
- Drive-by distribution of additional malware or redirect chains.
- Persistence, allowing attacks to continue until the payload is removed.
Realistic attack scenarios
- Public media upload endpoint: A “Submit a Listing” form accepts images. An attacker uploads an SVG with an
onloadhandler that injects JavaScript when viewers load the listing. - Targeting administrators: An attacker ensures the malicious SVG appears on a page an admin will review (e.g., pending listing). When the admin opens it, the script runs in their session and can escalate the attack.
- SEO poisoning / redirects: The payload injects spam content or cloaks redirects to malicious domains, harming visitors and site reputation.
Who is affected?
Sites running Houzez ≤ 4.1.6 that accept uploads or otherwise allow unauthenticated file submissions and render uploaded SVGs are at risk. Any user who visits pages that render the malicious SVG — including administrators — may be impacted.
Timeline and attribution
- Public reporting and advisory publication: late November 2025.
- Patch: Houzez 4.1.7 addresses the issue.
- Discovery: reported by a security researcher and disclosed responsibly.
How to detect whether you are affected
Follow these verification steps immediately:
- Confirm theme version
- WordPress admin: Appearance → Themes → Houzez (check version).
- Or via WP-CLI:
wp theme list.
- Search uploads for SVGs
Query the database for SVG mime types (example SQL):
SELECT ID, guid, post_mime_type FROM wp_posts WHERE post_mime_type = 'image/svg+xml';
Inspect recent SVG uploads and remove any you do not recognise.
- Inspect suspicious SVGs safely
