WordPress CitiLights theme <= 3.7.1 - Reflected Cross Site Scripting (XSS) vulnerability

The impact of this Reflected XSS vulnerability is significant. An attacker could craft a malicious URL containing JavaScript code and trick a user into clicking it. Upon visiting the URL, the injected script would execute within the user's browser context, with the same privileges as the user. This could allow the attacker to steal session cookies, redirect the user to a phishing site, or even modify the content of the web page. The blast radius extends to all users who interact with the vulnerable CitiLights theme, particularly those who click on links from untrusted sources. Successful exploitation could compromise user accounts and potentially lead to broader system compromise if the user has administrative privileges.

Websites using the CitiLights WordPress theme, particularly those with user-generated content or forms that accept user input without proper sanitization, are at risk. Shared hosting environments where multiple websites share the same server resources are also potentially affected, as a compromise of one site could lead to the compromise of others.

• wordpress / composer / npm:

grep -r "noo-citilights" /var/www/html/wp-content/themes/

• wordpress / composer / npm:

wp plugin list | grep citilights

• wordpress / composer / npm:

curl -I <vulnerable_url_with_payload> | grep -i content-security-policy

1. 2026-03-25Disclosure

   disclosure

1. आरक्षित2026-01-28
2. प्रकाशित2026-03-25
3. संशोधित2026-04-28
4. EPSS अद्यतन2026-04-02

The primary mitigation for CVE-2026-24973 is to immediately upgrade the CitiLights WordPress theme to version 3.7.2 or later. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider implementing temporary workarounds. These may include using a Web Application Firewall (WAF) with XSS filtering rules to block malicious requests, or carefully sanitizing user inputs before displaying them on the website. Regularly scan your WordPress installation for outdated plugins and themes to proactively identify and address potential vulnerabilities. After upgrading, confirm the fix by attempting to inject a simple JavaScript payload via a URL parameter and verifying that it is not executed.