Hi,
I’ve been using the Newsmag theme on my website, agakhanism.com, and it has recently been compromised with malware. My security advisor has informed me that the theme contain vulnerabilities, even though I’m using the most updated version available.
I’m very concerned about the risk of my website being hijacked due to this issue. It’s disappointing that a theme with such a high number of sales is not being properly maintained from a security standpoint.
Please look into this matter urgently. I need a solution as soon as possible to secure my website and prevent further issues.
Thank you.
Warning: Vulnerable tagDiv Theme Newsmag theme found at ./wp-content/themes/Newsmag/includes/tagdiv-config.php – Version: 5.4.3.3 – Please update this theme or switch it immediately: https://wpscan.com/vulnerability/038327d0-568f-4011-9b7e-3da39e8b6aea.
——————————–
Out of date software is the most common cause of website compromise. It’s highly recommended to get that updated as soon as you can.
Hi,
Thank you for your message!
It seems there may be a small misunderstanding. You mentioned the latest version of the Newsmag theme (5.4.3.3), but the vulnerability link you provided ( https://wpscan.com/vulnerability/038327d0-568f-4011-9b7e-3da39e8b6aea) actually refers to the Newspaper theme. That particular issue was resolved over two years ago.
As for Newsmag, the most recent update was on May 8th, 2025, which addressed an XSS vulnerability. There was also a previous XSS-related update on April 1st, 2025. You can find more details here: Newsmag on ThemeForest.
In the file located at ./wp-content/themes/Newsmag/includes/tagdiv-config.php, there’s just a class with a few arrays, a switch statement, and some define code. From what I can see, there’s nothing in this file that would typically be accessible from the outside or pose a security risk. It’s not clear how this could be exploited or lead to a vulnerability.
If you’re still seeing any warnings or issues related to the theme, please send over a detailed report, and I’ll be happy to forward it to our development team for further investigation.
Thanks again, and I appreciate your attention to this!
We are getting no security warnings in the latest release of Newsmag on PHP 8.3x.
To O.P. — good to look at general best practices for security for any modern website, wordpress install, etc.
————–
YOUR SITE:
Hardening Improvements
Security Headers
Missing security header for ClickJacking Protection. Alternatively, you can use Content-Security-Policy: frame-ancestors ‘none’.
Missing security header to prevent Content Type sniffing.
Missing Strict-Transport-Security security header.
Missing Content-Security-Policy directive. We recommend to add the following CSP directives (you can use default-src if all values are the same): script-src, object-src, base-uri, frame-src
Leaked PHP version. Your site is displaying your PHP version in the HTTP headers. Please set expose_php = Off.
