CVE-2024-5793

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

The Houzez Theme - Functionality plugin for WordPress is vulnerable to SQL Injection via the ‘currency_code’ parameter in all versions up to, and including, 3.2.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Custom-level (seller) access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

VendorProductVersions
FavethemesHouzez Theme - Functionality<= 3.2.2
favethemeshouzez<= 3.2.2

References

Timeline

Published
Jul 9, 2024
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2024

CVE-2024-579305.5In the Linux kernel, the following vulnerability has been resolved: tracing: Have process_string() also allow arrays In order to catch a cCVE-2024-579315.5In the Linux kernel, the following vulnerability has been resolved: selinux: ignore unknown extended permissions When evaluating extended CVE-2024-579325.5In the Linux kernel, the following vulnerability has been resolved: gve: guard XDP xmit NDO on existence of xdp queues In GVE, dedicated XCVE-2024-579335.5In the Linux kernel, the following vulnerability has been resolved: gve: guard XSK operations on the existence of queues This patch predicCVE-2024-579344.7In the Linux kernel, the following vulnerability has been resolved: fgraph: Add READ_ONCE() when accessing fgraph_array[] In __ftrace_retuCVE-2024-579355.5In the Linux kernel, the following vulnerability has been resolved: RDMA/hns: Fix accessing invalid dip_ctx during destroying QP If it faiCVE-2024-579365.5In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxt_re: Fix max SGEs for the Work Request Gen P7 supports up to CVE-2024-579385.5In the Linux kernel, the following vulnerability has been resolved: net/sctp: Prevent autoclose integer overflow in sctp_association_init()CVE-2024-579395.5In the Linux kernel, the following vulnerability has been resolved: riscv: Fix sleeping in invalid context in die() die() can be called inCVE-2024-579405.5In the Linux kernel, the following vulnerability has been resolved: exfat: fix the infinite loop in exfat_readdir() If the file system is CVE-2024-579415.5In the Linux kernel, the following vulnerability has been resolved: netfs: Fix the (non-)cancellation of copy when cache is temporarily disCVE-2024-579425.5In the Linux kernel, the following vulnerability has been resolved: netfs: Fix ceph copy to cache on write-begin At the end of netfs_unloc
CVE-2024-5793: High severity, CVSS 8.8 | Vulnix