What is the CVSS score of CVE-2026-24973?

CVE-2026-24973 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of Citilights are affected by CVE-2026-24973?

CVE-2026-24973 presents moderate security risk, a cross-site scripting vulnerability rated CVSS 7.1.

How to fix or mitigate CVE-2026-24973?

Within 7 days: Identify all affected systems and apply vendor patches promptly. Verify anti-CSRF tokens and content security policies are enforced.

Citilights CVE-2026-24973

EUVD-2026-15586 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-03-25 Patchstack

XSS Citilights

7.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 16:37 vuln.today

cvss_changed

EUVD ID Assigned

Mar 25, 2026 - 16:47 euvd

EUVD-2026-15586

Analysis Generated

Mar 25, 2026 - 16:47 vuln.today

CVE Published

Mar 25, 2026 - 16:14 nvd

HIGH 7.1

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NooTheme CitiLights noo-citilights allows Reflected XSS.This issue affects CitiLights: from n/a through <= 3.7.1.

AnalysisAI

A Reflected Cross-Site Scripting (XSS) vulnerability exists in NooTheme CitiLights WordPress theme versions up to and including 3.7.1, allowing attackers to inject malicious scripts into web pages viewed by other users. The vulnerability stems from improper neutralization of user input during web page generation (CWE-79), enabling attackers to execute arbitrary JavaScript in victims' browsers. An attacker can craft malicious URLs containing JavaScript payloads and trick users into clicking them, potentially leading to session hijacking, credential theft, or malware distribution.

Technical ContextAI

The CitiLights theme (identified via CPE cpe:2.3:a:nootheme:citilights:*:*:*:*:*:*:*:*) is a WordPress theme distributed through the WordPress ecosystem. The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), which represents the failure to sanitize or validate user-controlled input before it is reflected directly into HTML output. In the context of a WordPress theme, this typically occurs in template files that render GET or POST parameters without proper escaping via WordPress security functions (such as esc_html(), esc_attr(), or wp_kses_post()). Reflected XSS vulnerabilities differ from stored XSS in that the malicious payload is not persisted in a database but rather included in the request itself, making it dependent on tricking a user into clicking a specially crafted link.

RemediationAI

Upgrade NooTheme CitiLights to a version newer than 3.7.1 immediately, as the vulnerability affects all versions up to and including 3.7.1. Check the NooTheme website or WordPress theme repository for patched versions and apply updates through the WordPress admin dashboard. Until a patch can be applied, implement input validation and output encoding at the web server or WordPress plugin level by installing a Web Application Firewall (WAF) such as Wordfence or Sucuri that can filter malicious XSS payloads. Additionally, enforce Content Security Policy (CSP) headers to restrict inline script execution, and educate users and administrators to avoid clicking suspicious links. Monitor theme versions regularly and subscribe to NooTheme security advisories to receive notification of future patches. Consult the Patchstack advisory at https://patchstack.com/database/Wordpress/Theme/noo-citilights for vendor-specific remediation guidance.