Houzez WordPress Theme Stored Cross-Site Scripting Vulnerability via SVG Uploads

A stored cross-site scripting vulnerability has been identified in the Houzez theme for WordPress, affecting all versions through 4.1.6. The issue arises from inadequate input sanitization and output escaping in the 'houzez_property_img_upload()' and 'houzez_property_attachment_upload()' functions. This vulnerability allows unauthenticated attackers to upload SVG files containing malicious scripts, which are executed when a user accesses the file.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user viewing the property.

Remediation

Users can update to Houzez version 4.1.7 or later, where this vulnerability has been patched.