Houzez Theme CVE-2026-96339

Exploitation requires an attacker to deliver a crafted URL and a victim to click it (UI:R) while the Houzez theme (version n/a through 4.4.0) is active on the target WordPress site; the reflected nature means the payload is not stored, so each victim must be individually targeted through phishing or a malicious page. The specific vulnerable parameter/endpoint is not named in the provided description. Per the CVSS vector (PR:N), no attacker authentication is required, but impact is maximized when the clicking victim is an authenticated/privileged user whose session or browser context the injected script can abuse. Limiting factors: mandatory user interaction, dependence on the victim's privilege level, and the non-persistent (reflected) delivery model.

This is a reflected cross-site scripting (XSS) flaw in the Houzez WordPress theme (CWE-79) with a reported CVSS 3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L). The network attack vector, low complexity, and lack of required privileges (PR:N) make the payload cheap to craft, but the mandatory user interaction (UI:R) is the decisive limiting factor: a victim must be lured into clicking an attacker-crafted link, which makes exploitation targeted and social-engineering-dependent rather than automatable or wormable. No EPSS score, CISA KEV listing, or public proof-of-concept is present in the provided data, so there is no evidence of active exploitation or mass scanning - this profile fits a credible-but-not-urgent issue typical of Patchstack-reported WordPress theme XSS. The scope change (S:C) and only-Low confidentiality/integrity/availability impacts indicate the realistic worst case is session/context compromise of the victim's browser session (e.g., an administrator), not direct server takeover. Reflected (non-persistent) XSS inherently lowers real-world risk versus stored XSS because each victim must be individually delivered a malicious link. Net assessment: medium real-world priority - patch in normal cycles unless high-value admin accounts are exposed.

An attacker crafts a URL containing a malicious JavaScript payload in a parameter processed by the Houzez theme and delivers it to a logged-in user (ideally a site administrator) via phishing or a malicious web page. When the victim clicks the link, the unsanitized input is reflected back into the generated page and executes in their browser, letting the attacker hijack the session or perform actions in the victim's context. No public exploit code was identified in the provided data, and the required user interaction (UI:R) means delivery and a victim click are prerequisites.