Axiomthemes develops a moderately broad portfolio of WordPress themes and plugins aimed at e-commerce and content-rich sites, including products such as SmartSEO, Aromatica, Beautique, Catamaran, and Cerebrum. The vendor's vulnerabilities recur around characteristic web-application and PHP-based weaknesses: remote file inclusion, unsafe deserialization of untrusted data, and SQL injection, reflecting the integration demands and plugin architecture inherent to WordPress theme and extension development. These weakness classes represent common attack vectors against server-side code that processes external input or loads remote resources, and they can expose downstream WordPress sites to code execution and data compromise. Defenders deploying these themes should maintain current versions and audit for configuration issues around file handling and database queries; live severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Axiomthemes over time
Signals from CVEs in this vendor scope (64 CVEs).
64 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2026-57738CRITICAL Deserialization of Untrusted Data vulnerability in axiomthemes 777 triple-seven allows Object Injection.This issue affects 777: from n/a through <= 1.13.0. | Jul 13, 2026 | 9.8 | 40 | NO | NO |
CVE-2025-58935CRITICAL Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in axiomthemes Lunna lunna allows PHP Local File Inclusion.Thi | Dec 18, 2025 | 9.8 | 33 | NO | NO |
CVE-2025-60226CRITICAL Deserialization of Untrusted Data vulnerability in axiomthemes White Rabbit whiterabbit allows Object Injection.This issue affects White Rabbit: from n/a through <= 1.5.2. | Oct 22, 2025 | 9.8 | 29 | NO | NO |
CVE-2025-49401CRITICAL Incorrect Privilege Assignment vulnerability in axiomthemes smart SEO smartSEO allows Privilege Escalation.This issue affects smart SEO: from n/a through <= 4.0. | Sep 5, 2025 | 9.8 | 29 | NO | NO |
CVE-2025-28953HIGH Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in axiomthemes smart SEO smartSEO allows SQL Injection.This issue affects smart S | Nov 6, 2025 | 8.5 | 27 | NO | NO |
CVE-2025-49073CRITICAL Deserialization of Untrusted Data vulnerability in axiomthemes Sweet Dessert sweet-dessert allows Object Injection.This issue affects Sweet Dessert: from n/a through < 1.1.13. | Jun 6, 2025 | 9.8 | 26 | NO | NO |
CVE-2026-28117HIGH Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in axiomthemes smart SEO smartSEO allows PHP Local File Inclus | Mar 5, 2026 | 8.1 | 25 | NO | NO |
CVE-2025-60067HIGH Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in axiomthemes Giardino giardino allows PHP Local File Inclusi | Dec 18, 2025 | 8.1 | 25 | NO | NO |
CVE-2025-60066HIGH Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in axiomthemes Katelyn katelyn allows PHP Local File Inclusion | Dec 18, 2025 | 8.1 | 25 | NO | NO |
CVE-2025-60065HIGH Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in axiomthemes Pinevale pinevale allows PHP Local File Inclusi | Dec 18, 2025 | 8.1 | 25 | NO | NO |
Signals from CVEs in this vendor scope (64 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Axiomthemes.
Media articles that mention a CVE ID that affects a product developed by Axiomthemes — matched by CVE ID, not by vendor name.