GCVE - cpe:2.3:a:nootheme:citilights:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:nootheme:citilights:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Nootheme (`605deb65-511e-57cf-a5f4-6d840e31956c`)
Product	Citilights (`c0fa825b-e664-5fb2-a295-cbc75554e0f8`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2026-25367`	vulnerable	2026-06-08 07:53:19.713767	WordPress CitiLights theme < 3.7.2 - Broken Access Control vulnerability MEDIUM (5.3) Missing Authorization vulnerability in NooTheme CitiLights noo-citilights allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CitiLights: from n/a through < 3.7.2. Published: 2026-02-19T08:26:59.651Z Updated: 2026-04-28T16:14:56.930Z Open on db.gcve.eu Reference links https://patchstack.com/database/Wordpress/Theme/noo-citilights/vulnerability/wordpress-citilights-theme-3-7-2-broken-access-control-vulnerability?_s_id=cve	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-24974`	vulnerable	2026-06-08 07:53:18.777815	WordPress CitiLights theme <= 3.7.1 - PHP Object Injection vulnerability HIGH (8.8) Deserialization of Untrusted Data vulnerability in NooTheme CitiLights noo-citilights allows Object Injection.This issue affects CitiLights: from n/a through <= 3.7.1. Published: 2026-03-25T16:14:34.280Z Updated: 2026-04-28T16:14:52.209Z Open on db.gcve.eu Reference links https://patchstack.com/database/Wordpress/Theme/noo-citilights/vulnerability/wordpress-citilights-theme-3-7-1-php-object-injection-vulnerability?_s_id=cve	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-24973`	vulnerable	2026-06-08 07:53:18.777453	WordPress CitiLights theme <= 3.7.1 - Reflected Cross Site Scripting (XSS) vulnerability HIGH (7.1) Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NooTheme CitiLights noo-citilights allows Reflected XSS.This issue affects CitiLights: from n/a through <= 3.7.1. Published: 2026-03-25T16:14:34.123Z Updated: 2026-04-28T16:14:51.940Z Open on db.gcve.eu Reference links https://patchstack.com/database/Wordpress/Theme/noo-citilights/vulnerability/wordpress-citilights-theme-3-7-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.