Skip to content
OpenAdvisories
Critical · 9.8 Scanner template Public exploit CVE-2020-36708 EUVD-2020-24150GHSA-48h4-c5mw-4h8j

Epsilon Framework Themes (Various Versions) - Function Injection

Published Jun 7, 2023 · Updated Apr 8, 2026 · Assigned by Wordfence

Vendor: Macho Themes Vendor: silkalns Vendor: WP Chill Product: Activello Product: Affluent Product: Allegiant Product: Antreas Product: Bonkers Product: Brilliance Product: Illdy Product: MedZone Lite Product: NatureMag Lite Product: NewsMag Product: Newspaper X Product: Pixova Lite Product: Regina Lite Product: Shapely Product: Sparkling Product: Transcend

Description

The following themes for WordPress are vulnerable to Function Injections in versions up to and including Shapely <= 1.2.7, NewsMag <= 2.4.1, Activello <= 1.4.0, Illdy <= 2.1.4, Allegiant <= 1.2.2, Newspaper X <= 1.3.1, Pixova Lite <= 2.0.5, Brilliance <= 1.2.7, MedZone Lite <= 1.2.4, Regina Lite <= 2.0.4, Transcend <= 1.1.8, Affluent <= 1.1.0, Bonkers <= 1.0.4, Antreas <= 1.0.2, Sparkling <= 2.4.8, and NatureMag Lite <= 1.0.4. This is due to epsilon_framework_ajax_action. This makes it possible for unauthenticated attackers to call functions and achieve remote code execution.

Affected products

VendorProductAffectedFixed
machothemes Antreas ≤ 1.0.2 —
machothemes NatureMag Lite ≤ 1.0.4 —
silkalns Bonkers ≤ 1.0.4 —
wpchill Affluent ≤ 1.1.0 —
wpchill Transcend ≤ 1.1.8 —
wpchill Allegiant ≤ 1.2.2 —
machothemes MedZone Lite ≤ 1.2.4 —
silkalns Shapely ≤ 1.2.7 —
wpchill Brilliance ≤ 1.2.7 —
silkalns Newspaper X ≤ 1.3.1 —
silkalns Activello ≤ 1.4.0 —
machothemes Regina Lite ≤ 2.0.4 —
silkalns Pixova Lite ≤ 2.0.5 —
silkalns Illdy ≤ 2.1.4 —
machothemes NewsMag ≤ 2.4.1 —
silkalns Sparkling ≤ 2.4.8 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Automated scanner template

A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.

Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.

References