Attack Vectors

CVE-2026-24973 is a Medium-severity (CVSS 6.1) reflected cross-site scripting (XSS) issue affecting the Support for CitiLights – Real Estate WordPress Theme (slug: noo-citilights) in versions up to and including 3.7.1.

Because this is a reflected XSS vulnerability, an unauthenticated attacker can attempt to deliver a specially crafted URL (for example via email, social media messages, paid ads, or contact forms) that causes a script to be reflected back in a page response. The attack succeeds when a user is persuaded to click the link or otherwise trigger the request in their browser (user interaction is required).

Common real-world paths to exploitation include spear-phishing a marketing or finance team member with a convincing “listing inquiry,” “contract update,” or “analytics alert” link, or embedding the malicious link in channels where employees routinely click (CRM notes, ticketing systems, shared documents, and internal chat).

Security Weakness

The underlying weakness is insufficient input sanitization and output escaping in the theme, allowing untrusted input to be returned to the browser in a way that can be interpreted as active code. In practical terms, the site can be made to serve a page that includes attacker-controlled script content when a victim visits a crafted URL.

The scope is important for leadership: while the attacker may not need a login to launch the attempt, the business risk increases significantly if the victim is logged in (for example, an editor, marketing administrator, or site admin) when they click the link, because the browser may carry authenticated session context.

Remediation is straightforward: update Support for CitiLights – Real Estate WordPress Theme to version 3.7.2 or newer, which is the patched release according to the public advisory source.

Technical or Business Impacts

Reflected XSS can lead to session and account compromise (if an authenticated user is targeted), unauthorized actions performed in the victim’s browser, and exposure of sensitive information displayed in the session (such as contact records, lead details, or admin-only views). Even when impact is “limited” per CVSS (confidentiality/integrity impact noted, no direct availability impact), it can still create a high-cost incident depending on who clicks.

From a business perspective, the most material risks include brand damage (customers receiving malicious links that appear to originate from your domain), lead diversion (tampering with forms or on-page behavior to reroute inquiries), and compliance exposure if personal data is accessed or misused. Marketing operations are often impacted first: campaign landing pages, tracking workflows, and conversion funnels may be manipulated in ways that are difficult to detect quickly.

Recommended actions for leadership: ensure the theme is updated to 3.7.2+, confirm no production sites are pinned to older versions, and coordinate a quick validation with your web team (or managed provider) that the patched version is live across all environments (production, staging, and any regional microsites).

Similar Attacks

Reflected XSS has been repeatedly used in phishing-style workflows to compromise users and web sessions. Examples include:

CISA Alert on code injection vulnerabilities affecting multiple products (includes XSS as a common class)

OWASP: Cross-Site Scripting (XSS) overview and real-world risk discussion

CVE record for CVE-2026-24973 (Support for CitiLights – Real Estate WordPress Theme reflected XSS)