The Zakra WordPress theme registers three post meta fields that are exposed through the REST API without proper sanitization; when a contributor or higher‑level user creates or updates these fields via the API, the unsanitized values are stored and later concatenated directly into CSS strings output by wp_add_inline_style without escaping. This allows an attacker to inject arbitrary JavaScript that will execute in the browsers of any visitor to the affected page, compromising the integrity of site content. The flaw stems from missing sanitize_callback parameters in register_post_meta() calls while still permitting the fields to be accessed by the API.

All WordPress installations using ThemeGrill's Zakra theme up to and including version 4.2.0 are vulnerable. The issue is limited to the Zakra product and only affects users with Contributor or elevated roles who can modify post meta through the REST API.

The vulnerability has a CVSS score of 6.4, indicating moderate severity, and an EPSS score of less than 1%, suggesting a low probability of exploitation at the present time. It is not listed in CISA’s KEV catalog. Attackers must first have Contributor or higher privileges to insert malicious payloads. Once injected, the script runs client‑side whenever any visitor loads the injected post or page. The lack of immediate exploitation data means the risk is lower, but the impact remains significant if abused.