Axiomthemes has 16 CVEs on record between 2025 and 2026. Disclosure cadence is accelerating: 11 in the last 90 days against 0 in the 90 before. The busiest recent month was October 2026 with 11. The median CVSS is 9.8 (critical), with 11 rated critical. None have a confirmed exploitation report. The dominant weakness classes are CWE-502 (11) and CWE-98 (4).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 9.8
- Publish → KEV
- —
- Last 90 days
- 11 prev 0
Weakness classes
Products
- FC United 1
- Kicker 1
- Kids Care 1
- Original 1
- balance 1
- hallelujah 1
Worst active — by depth score
CVE-2026-112858Critical· 9.8WordPress Rhodos theme <= 1.3.3 - PHP Object Injection vulnerability54CVE-2026-112857Critical· 9.8WordPress Reprizo theme <= 1.0.8 - PHP Object Injection vulnerability54CVE-2026-112855Critical· 9.8WordPress Redy theme <= 1.3.5 - PHP Object Injection vulnerability54CVE-2026-112854Critical· 9.8WordPress Holistic Center theme <= 1.2.6 - PHP Object Injection vulnerability54CVE-2026-112853Critical· 9.8WordPress Hallelujah theme <= 1.1.1 - PHP Object Injection vulnerability54
Axiomthemes vulnerabilities
CVEs affecting Axiomthemes, newest first. Open any entry for full detail, references, and exploit status.
16 CVEsRSS
CVE-2026-112854Critical· 9.8WordPress Holistic Center theme <= 1.2.6 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in axiomthemes Holistic Center holistic-center allows Object Injection.This issue affects Holistic Center: from n/a through 1.2.6.
CVE-2026-112855Critical· 9.8WordPress Redy theme <= 1.3.5 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in axiomthemes Redy redy allows Object Injection.This issue affects Redy: from n/a through 1.3.5.
CVE-2026-112858Critical· 9.8WordPress Rhodos theme <= 1.3.3 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in axiomthemes Rhodos rhodos allows Object Injection.This issue affects Rhodos: from n/a through 1.3.3.
CVE-2026-112857Critical· 9.8WordPress Reprizo theme <= 1.0.8 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in axiomthemes Reprizo reprizo allows Object Injection.This issue affects Reprizo: from n/a through 1.0.8.
CVE-2026-112853Critical· 9.8WordPress Hallelujah theme <= 1.1.1 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in axiomthemes Hallelujah hallelujah allows Object Injection.This issue affects Hallelujah: from n/a through 1.1.1.
CVE-2026-66569Critical· 9.8Unauthenticated PHP Object Injection in Kicker <= 2.2.1 versions.
Unauthenticated PHP Object Injection in Kicker <= 2.2.1 versions.
CVE-2026-66568Critical· 9.8Unauthenticated PHP Object Injection in Original <= 1.9.0 versions.
Unauthenticated PHP Object Injection in Original <= 1.9.0 versions.
CVE-2026-66565Critical· 9.8Unauthenticated PHP Object Injection in FC United <= 1.1.1 versions.
Unauthenticated PHP Object Injection in FC United <= 1.1.1 versions.
CVE-2026-42704High· 8.1Unauthenticated Local File Inclusion in Kids Care <= 3.2.4 versions.
Unauthenticated Local File Inclusion in Kids Care <= 3.2.4 versions.
CVE-2026-93945Critical· 9.8Deserialization of Untrusted Data vulnerability in Axiomthemes Balance balance allows Object Injection.This issue affects Balance: from n/a through 1.12.0.
Deserialization of Untrusted Data vulnerability in Axiomthemes Balance balance allows Object Injection.This issue affects Balance: from n/a through 1.12.0.
CVE-2026-93927Critical· 9.8Deserialization of Untrusted Data vulnerability in Axiomthemes Veto veto allows Object Injection.This issue affects Veto: from n/a through 1.6.0.
Deserialization of Untrusted Data vulnerability in Axiomthemes Veto veto allows Object Injection.This issue affects Veto: from n/a through 1.6.0.
CVE-2025-60049High· 8.1Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in axiomthemes Soleil soleil allows PHP Local File Inclusion.This issue affects Soleil: from n/a through <= 1.17.
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in axiomthemes Soleil soleil allows PHP Local File Inclusion.This issue affects Soleil: from n/a through <= 1.17.
CVE-2025-58946High· 8.1Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in axiomthemes Vocal vocal allows PHP Local File Inclusion.This issue affects Vocal: from n/a through <= 1.12.
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in axiomthemes Vocal vocal allows PHP Local File Inclusion.This issue affects Vocal: from n/a through <= 1.12.
CVE-2025-58949High· 8.1Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in axiomthemes Spock spock allows PHP Local File Inclusion.This issue affects Spock: from n/a through <= 1.17.
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in axiomthemes Spock spock allows PHP Local File Inclusion.This issue affects Spock: from n/a through <= 1.17.
CVE-2025-28953High· 8.5Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in axiomthemes smart SEO smartSEO allows SQL Injection.This issue affects smart SEO: from n/a through <= 4.0.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in axiomthemes smart SEO smartSEO allows SQL Injection.This issue affects smart SEO: from n/a through <= 4.0.
CVE-2025-60226Critical· 9.8Deserialization of Untrusted Data vulnerability in axiomthemes White Rabbit whiterabbit allows Object Injection.This issue affects White Rabbit: from n/a through <= 1.5.2.
Deserialization of Untrusted Data vulnerability in axiomthemes White Rabbit whiterabbit allows Object Injection.This issue affects White Rabbit: from n/a through <= 1.5.2.