An attacker can inject malicious scripts into the browser by supplying crafted input that the NooTheme CitiLights WordPress theme reflects directly into the page. The scripts execute in the context of the visitor’s session, allowing the attacker to run code that the site’s users subsequently load.

WordPress sites using the NooTheme CitiLights theme with version 3.7.1 or earlier are affected. Any deployment of this theme that has not been updated past that version remains vulnerable.

The CVSS score of 7.1 indicates high severity. EPSS data is unavailable and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is client‑side reflected input, such as a specially crafted URL or form submission accessed by a victim. No privileged access is required, making the vulnerability readily exploitable.