WordPress security by component
CitiLights
Theme description
CitiLights is a WordPress component with 3 published CVE records in this archive. The latest tracked vulnerability was published Mar 25, 2026; the highest CVE/CNA score is 8.8.
Theme slug:
noo-citilightsLatest vulnerability
CVE-2026-24974: CitiLights: Code execution
CitiLights is affected by code execution. Exposure depends on how the affected operation is made reachable by the site. Successful exploitation can run attacker-controlled code in the WordPress hosting account. The published affected range is <= 3.7.1.
| Safe version |
|
||
|---|---|---|---|
| Mar 25, 2026 |
CVE-2026-24974
CitiLights: Code execution
CitiLights is affected by code execution. Exposure depends on how the affected operation is made reachable by the site. Successful exploitation can run attacker-controlled code in the WordPress hosting account. The published affected range is <= 3.7.1.
|
3.7.2 |
CVE8.8
NVDPending
|
| Mar 25, 2026 |
CVE-2026-24973
CitiLights: Cross-site scripting
CitiLights is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The published affected range is <= 3.7.1.
|
3.7.2 |
CVE7.1
NVDPending
|
| Feb 19, 2026 |
CVE-2026-25367
CitiLights: A security weakness
CitiLights is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE5.3
NVDPending
|