PT-2026-55517 · Themegrill · Zakra

Published 2026-07-03 · Updated 2026-07-03 · CVE-2026-4804

NVD

CVSS v3.1

6.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

The Zakra theme for WordPress is vulnerable to Stored Cross-Site Scripting via post meta values in all versions up to, and including, 4.2.0. This is due to the theme registering three post meta fields (zakra menu item color, zakra menu item hover color, and zakra menu item active color) with 'show in rest' => true and 'auth callback' => ' return true', but without any sanitize callback parameter in the register post meta() calls. While the classic editor save path applies sanitize hex color() sanitization, the REST API path completely bypasses this protection. The unsanitized meta values are then retrieved via get post meta() and concatenated directly into CSS strings that are output through wp add inline style() without any escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the injected page.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-4804

Affected Products

Zakra

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-4804 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/bbda67a3-0413-4d8e-8157-84c9c87b8695?source=cve · Note
• https://themes.trac.wordpress.org/changeset?reponame=&new=330192%40zakra%2F4.2.1&old=297420%40zakra%2F4.2.0#file39 · Note