The Truemag theme 2016 Q2 for WordPress has XSS via the s parameter.
truemag theme project truemag theme 2016_q2