CVE-2026-65560

Unauthenticated Cross Site Scripting XSS in Houzez Property Feed = 2.5.48 versions...

CVE-2026-65560 WordPress Houzez Property Feed plugin <= 2.5.48 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Houzez Property Feed = 2.5.48 versions...

EUVD-2026-53985

Unauthenticated Cross Site Scripting XSS in Houzez Property Feed = 2.5.48 versions...

CVE-2026-65560 WordPress Houzez Property Feed plugin <= 2.5.48 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Houzez Property Feed = 2.5.48 versions...

CVE-2026-65560

The vulnerability CVE-2026-65560 is an Unauthenticated XSS in the WordPress Houzez Property Feed plugin, affected versions

CVE-2026-65560

Unauthenticated Cross Site Scripting XSS in Houzez Property Feed = 2.5.48 versions...

WordPress Houzez Property Feed plugin <= 2.5.48 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by dutafi in WordPress Plugin Houzez Property Feed versions = 2.5.48...

CVE-2026-65560: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Houzez Property Feed = 2.5.48 versions...

PT-2026-68556

Name of the Vulnerable Software and Affected Versions Houzez Property Feed versions prior to 2.5.49 Description The Houzez Property Feed plugin for WordPress contains a stored Cross-Site Scripting XSS flaw. This issue occurs because the software fails to properly sanitize input and escape output,...

CVE-2026-13357

The Houzez Property Feed plugin for WordPress is vulnerable to SQL Injection via the 'orderby' parameter in all versions up to, and including, 2.5.46 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query in the prepareitems method...

CVE-2026-13357

The Houzez Property Feed WordPress plugin (up to version 2.5.46) is vulnerable to SQL Injection via the 'orderby' parameter. The issue stems from user-controlled $_GET['orderby'] and $_GET['order'] being filtered only with sanitize_text_field() and concatenated into the SQL format string before $...

CVE-2026-13357 Houzez Property Feed <= 2.5.46 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter

The Houzez Property Feed plugin for WordPress is vulnerable to SQL Injection via the 'orderby' parameter in all versions up to, and including, 2.5.46 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query in the prepareitems method...

CVE-2026-13357

The Houzez Property Feed plugin for WordPress is vulnerable to SQL Injection via the 'orderby' parameter in all versions up to, and including, 2.5.46 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query in the prepareitems method...

CVE-2026-13357 Houzez Property Feed <= 2.5.46 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter

The Houzez Property Feed plugin for WordPress is vulnerable to SQL Injection via the 'orderby' parameter in all versions up to, and including, 2.5.46 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query in the prepareitems method...

EUVD-2026-41246

The Houzez Property Feed plugin for WordPress is vulnerable to SQL Injection via the 'orderby' parameter in all versions up to, and including, 2.5.46 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query in the prepareitems method...

CVE-2026-13357: Improper Neutralization of Special Elements used in an SQL Command

The Houzez Property Feed plugin for WordPress is vulnerable to SQL Injection via the 'orderby' parameter in all versions up to, and including, 2.5.46 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query in the prepareitems method...

PT-2026-54629

The Houzez Property Feed plugin for WordPress is vulnerable to SQL Injection via the 'orderby' parameter in all versions up to, and including, 2.5.46 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query in the prepare items metho...

WordPress Houzez Property Feed plugin <= 2.5.46 - Authenticated (Administrator+) SQL Injection vulnerability

Authenticated Administrator+ SQL Injection vulnerability discovered by PRISM in WordPress Plugin Houzez Property Feed versions = 2.5.46...

EUVD-2025-9103

Malicious code in bioql PyPI...

CVE-2025-30793

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Property Hive Houzez Property Feed houzez-property-feed allows Path Traversal.This issue affects Houzez Property Feed: from n/a through = 2.5.4...