The following themes for WordPress are vulnerable to Function Injections in versions up to and including Shapely <= 1.2.7, NewsMag <= 2.4.1, Activello <= 1.4.0, Illdy <= 2.1.4, Allegiant <= 1.2.2, Newspaper X <= 1.3.1, Pixova Lite <= 2.0.5, Brilliance <= 1.2.7, MedZone Lite <= 1.2.4, Regina Lite <= 2.0.4, Transcend <= 1.1.8, Affluent <= 1.1.0, Bonkers <= 1.0.4, Antreas <= 1.0.2, Sparkling <= 2.4.8, and NatureMag Lite <= 1.0.4. This is due to epsilon_framework_ajax_action. This makes it possible for unauthenticated attackers to call functions and achieve remote code execution.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Activello Theme | — | Update activello theme to version 1.4.2, or a newer patched version | Dec 8, 2025 | Oct 1, 2020 |
| Affluent Theme | — | Update affluent theme to version 1.1.2, or a newer patched version | Dec 8, 2025 | Oct 1, 2020 |
| Allegiant Theme | — | Update allegiant theme to version 1.2.6, or a newer patched version | Dec 8, 2025 | Oct 1, 2020 |
| Antreas Theme | — | Update antreas theme to version 1.0.7, or a newer patched version | Dec 8, 2025 | Oct 1, 2020 |
| Bonkers Theme | — | Update bonkers theme to version 1.0.6, or a newer patched version | Dec 8, 2025 | Oct 1, 2020 |
| Brilliance Theme | — | Update brilliance theme to version 1.3.0, or a newer patched version | Dec 8, 2025 | Oct 1, 2020 |
| Illdy Theme | — | Update illdy theme to version 2.1.7, or a newer patched version | Dec 8, 2025 | Oct 1, 2020 |
| Medzone Lite Theme | — | Update medzone-lite theme to version 1.2.6, or a newer patched version | Dec 8, 2025 | Oct 1, 2020 |
| Naturemag Lite Theme | — | Update naturemag-lite theme to version 1.0.5, or a newer patched version | Dec 8, 2025 | Oct 1, 2020 |
| Newsmag Theme | — | Update newsmag theme to version 2.4.2, or a newer patched version | Dec 8, 2025 | Oct 1, 2020 |
| Newspaper X Theme | — | Update newspaper-x theme to version 1.3.2, or a newer patched version | Dec 8, 2025 | Oct 1, 2020 |
| Pixova Lite Theme | — | Update pixova-lite theme to version 2.0.7, or a newer patched version | Dec 8, 2025 | Oct 1, 2020 |
| Regina Lite Theme | — | Update regina-lite theme to version 2.0.6, or a newer patched version | Dec 8, 2025 | Oct 1, 2020 |
| Shapely Theme | — | Update shapely theme to version 1.2.9, or a newer patched version | Dec 8, 2025 | Oct 1, 2020 |
| Sparkling Theme | — | Update sparkling theme to version 2.4.9, or a newer patched version | Dec 8, 2025 | Oct 1, 2020 |
| Transcend Theme | — | Update transcend theme to version 1.2.0, or a newer patched version | Dec 8, 2025 | Oct 1, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub