Houzez Plugin up to 4.1.6 on WordPress Saved Search saved-search-item.php deserialization

Summaryinfo

A vulnerability categorized as critical has been discovered in Houzez Plugin up to 4.1.6 on WordPress. Affected by this vulnerability is an unknown functionality of the file saved-search-item.php of the component Saved Search Handler. Executing a manipulation can lead to deserialization. This vulnerability is handled as CVE-2025-9191. The attack can be executed remotely. There is not any exploit available.

Detailsinfo

A vulnerability classified as critical was found in Houzez Plugin up to 4.1.6 on WordPress. This vulnerability affects an unknown functionality of the file saved-search-item.php of the component Saved Search Handler. The manipulation with an unknown input leads to a deserialization vulnerability. The CWE definition for the vulnerability is CWE-502. The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

The Houzez theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.1.6 via deserialization of untrusted input in saved-search-item.php. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.

The advisory is available at wordfence.com. This vulnerability was named CVE-2025-9191. The exploitation appears to be easy. The attack can be initiated remotely. Technical details are known, but there is no available exploit. The structure of the vulnerability defines a possible price range of USD $0-$5k at the moment (estimation calculated on 11/27/2025).

By approaching the search of inurl:saved-search-item.php it is possible to find vulnerable targets with Google Hacking.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2025-199719). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• WordPress Plugin

Name

• Houzez Plugin

Version

• 4.1.0
• 4.1.1
• 4.1.2
• 4.1.3
• 4.1.4
• 4.1.5
• 4.1.6

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion