CVE-2025-49407: 
WordPress vulnerability analysis and mitigation

A Cross-site Scripting (XSS) vulnerability has been identified in favethemes Houzez WordPress theme, tracked as CVE-2025-49407. The vulnerability was discovered on August 27, 2025, and affects versions through 4.1.1. This is a reflected XSS vulnerability that allows unauthenticated attackers to inject malicious scripts into web pages (Patchstack).

The vulnerability has been assigned a CVSS v3.1 base score of 7.1 (High), with the following vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. This indicates that the vulnerability can be exploited remotely (Network), requires low attack complexity, needs no privileges, but does require user interaction. The scope is changed, with low impact on confidentiality, integrity, and availability (Patchstack).

The vulnerability could allow malicious actors to inject malicious scripts, including redirects, advertisements, and other HTML payloads into the website. These injected scripts would be executed when guests visit the affected site, potentially compromising user data and website integrity (Patchstack).

Users are advised to update to Houzez version 4.1.4 or later to resolve the vulnerability. For immediate protection, Patchstack has issued a virtual patch to mitigate this issue by blocking potential attacks until users can update to a fixed version (Patchstack).