Truemag Vulnerabilities

The Truemag theme for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 4.3.14.2. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls,...

CVSS:

8.1

Affected:

up to 4.3.14.2

Fix:

No patched version reported

Disclosed:

May 27, 2026

CVE-2025-69178 on NVD →

[en] The Truemag theme 2016 Q2 for WordPress has XSS via the s parameter.

Affected:

up to 4.2.8

Fix:

No patched version reported

Disclosed:

Sep 18, 2019

CVE-2016-10994 on NVD →

The Truemag theme 2016 Q2 for WordPress has XSS via the s parameter.

CVSS:

6.1

Affected:

up to *

Fix:

No patched version reported

Disclosed:

Apr 29, 2016

CVE-2016-10994 on NVD →

The vulnerability is located in the "s" value of the page module GET method request. Because of this vulnerability remote attackers are able to inject own malicious script codes to the client-side of the online service web-application to compromise user session information or data. Update the theme.

Affected:

up to 1.1

Fixed in:

1.1

Disclosed:

Apr 29, 2016