WordPress plugin
Houzez Property Feed security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 4 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical0
- High2
- Medium2
- Low0
All Houzez Property Feed vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| High7.2 | Unauthenticated Stored Cross-Site Scripting ≤2.5.48Update to 2.5.49 | CVE-2026-65560 | |
| Medium4.9 | Authenticated (Administrator+) SQL Injection via 'orderby' Parameter ≤2.5.46Update to 2.5.47 | CVE-2026-13357 | |
| High7.5 | Unauthenticated Arbitrary File Download ≤2.5.4Update to 2.5.5 | CVE-2025-30793 | |
| Medium4.3 | Cross-Site Request Forgery to Property Feed Export Deletion ≤2.4.21Update to 2.4.22 | CVE-2025-0808 |
- High7.2Unauthenticated Stored Cross-Site Scripting
≤2.5.48Update to 2.5.49
- Medium4.9Authenticated (Administrator+) SQL Injection via 'orderby' Parameter
≤2.5.46Update to 2.5.47
- High7.5Unauthenticated Arbitrary File Download
≤2.5.4Update to 2.5.5
- Medium4.3Cross-Site Request Forgery to Property Feed Export Deletion
≤2.4.21Update to 2.4.22
Houzez Property Feed: common questions
Does Houzez Property Feed have known vulnerabilities?
Yes. VulnCrest Radar lists 4 known vulnerabilities in Houzez Property Feed: 2 high, 2 medium. None are known to affect version null.
How do I check which version of Houzez Property Feed I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent Houzez Property Feed vulnerability?
CVE-2026-65560, published Aug 6, 2026: Houzez Property Feed <= 2.5.48 - Unauthenticated Stored Cross-Site Scripting. Severity: High (CVSS 7.2).
Is any Houzez Property Feed vulnerability listed in CISA KEV?
No. None of the known Houzez Property Feed vulnerabilities is currently listed in the CISA KEV catalog.