The Ultralight
The Ultralight has one disclosed vulnerability in the WordSec catalog, all reported in 2025; it remains unpatched as of September 2026. Their average CVSS score is 6.1, and the most serious one scores 6.1 out of 10.
The most common weakness is Cross-Site Scripting, behind 1 of the records (100%).
The one issue recorded for The Ultralight has no published fix yet, which makes virtual patching the only reliable mitigation. The oldest unresolved one dates back to 2025.
All of these findings were reported by akas wisnu aji. The Ultralight is installed on roughly 200 WordPress sites, so each unpatched flaw has a wide blast radius.
CVE-2025-23998UltraLight <= 1.2 - Reflected Cross-Site Scripting
Read the full analysisVulnerability Records

The Ultralight
Author
Rara Themes
The Ultralight theme is a clean and lightweight free WordPress blog theme. The theme is totally optimized to boost browsing speed. The theme is very lightweight and loads quickly improving the overall user experience. The theme has a responsive design and SEO-friendly optimized codes. The theme is developed using SEO in mind, so that you can easily climb the Google ranking. The theme is easy on eye and a pleasure to read with its clutter-free design focused on the content with neat fonts and subtle color scheme. It is also WooCommerce compatible and translation ready. Apart from personal blog, it is also suitable for different kinds of blogs such as lifestyle, travel, food, fashion, photography, beauty, make-up, parenting or cooking blog. Check the demo at https://rarathemes.com/previews/?theme=the-ultralight/, documentation at https://docs.rarathemes.com/docs/the-ultralight/, and get support at https://rarathemes.com/support-ticket/.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C