Newspaper is a famous theme from TagDiv on themeforest, with about 95,000 sells.
We found in the file
Check the code:
The line 8 (383 in functions.php) just read the
update_theme variable from the URL in the browser, then line 21 (395 in functions.php) will print it as is, without any escape or sanitization.
The version 10.3.4 fixed the flaw, just update and you’re good.