What is the CVSS score of CVE-2025-28953?

CVE-2025-28953 has a CVSS 3.1 base score of 8.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.0%.

Which versions of smartSEO WordPress Theme are affected by CVE-2025-28953?

CVE-2025-28953 is a high-severity SQL injection vulnerability in axiomthemes smartSEO WordPress theme (versions ≤4.0) that allows authenticated users with low-privilege access to extract sensitive…

How to fix or mitigate CVE-2025-28953?

Within 24 hours: Inventory all WordPress installations using axiomthemes smartSEO theme and document current versions. Within 7 days: Disable or remove the smartSEO theme on all affected WordPress instances; apply principle of least privilege to WordPress user accounts to restrict authenticated access. Within 30 days: Monitor vendor advisory channels for patch release (version 4.1 or later if available); implement Web Application Firewall rules to detect SQL injection patterns in smartSEO requests; upgrade theme immediately upon patch availability and re-enable only after applying vendor fix.

smartSEO WordPress Theme CVE-2025-28953

HIGH

SQL Injection (CWE-89)

2025-11-06 audit@patchstack.com

SQLi

8.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.5 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Updated

Apr 24, 2026 - 01:10 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 23, 2026 - 15:43 vuln.today

cvss_changed

Analysis Generated

Mar 28, 2026 - 19:20 vuln.today

CVE Published

Nov 06, 2025 - 16:15 nvd

HIGH 8.5

DescriptionCVE.org

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in axiomthemes smart SEO smartSEO allows SQL Injection.This issue affects smart SEO: from n/a through <= 4.0.

AnalysisAI

SQL injection in axiomthemes smartSEO WordPress theme versions up to 4.0 enables authenticated attackers to extract sensitive database information and potentially cause service disruption. Exploitation requires low-privilege authenticated access but can impact resources beyond the vulnerable component (scope change). EPSS score of 0.05% indicates low observed exploitation probability, with no CISA KEV listing or public POC identified at time of analysis.

Technical ContextAI

This vulnerability stems from improper neutralization of SQL special characters (CWE-89) in the axiomthemes smartSEO WordPress theme. The affected component fails to properly sanitize user-supplied input before incorporating it into SQL queries, allowing attackers to inject arbitrary SQL commands. WordPress themes often interact with the WordPress database through custom queries for SEO functionality (meta tags, sitemaps, analytics), and insufficient input validation in these database operations creates injection opportunities. The CPE identifier confirms this affects the smartSEO theme for WordPress specifically, not the core WordPress application.

RemediationAI

Primary remediation requires updating axiomthemes smartSEO theme to a patched version beyond 4.0, though the exact fixed version number was not independently confirmed in available data sources at time of analysis. Contact axiomthemes directly or monitor the Patchstack advisory at https://patchstack.com/database/Wordpress/Theme/smartSEO/vulnerability/wordpress-smart-seo-4-0-sql-injection-vulnerability for official patch release information. If immediate patching is not feasible, implement defense-in-depth controls: restrict WordPress user account creation and enforce principle of least privilege to limit who holds even low-level authenticated access (reducing the PR:L attack surface); enable WordPress database activity monitoring to detect SQL injection attempts through anomalous query patterns; deploy web application firewall rules to filter SQL metacharacters in theme-related requests, though this may interfere with legitimate SEO configuration functionality; consider temporarily disabling the smartSEO theme and migrating to alternative SEO solutions like Yoast SEO or Rank Math if business continuity allows, accepting the operational cost of reconfiguring SEO settings. Database-level controls such as read-only replicas for theme queries would reduce confidentiality impact but require significant architectural changes.