Description
The Zakra theme for WordPress is vulnerable to Stored Cross-Site Scripting via post meta values in all versions up to, and including, 4.2.0. This is due to the theme registering three post meta fields (zakra_menu_item_color, zakra_menu_item_hover_color, and zakra_menu_item_active_color) with 'show_in_rest' => true and 'auth_callback' => '__return_true', but without any sanitize_callback parameter in the register_post_meta() calls. While the classic editor save path applies sanitize_hex_color() sanitization, the REST API path completely bypasses this protection. The unsanitized meta values are then retrieved via get_post_meta() and concatenated directly into CSS strings that are output through wp_add_inline_style() without any escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the injected page.
Published: 2026-07-03
Score: 6.4 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The Zakra WordPress theme registers three post meta fields that are exposed via the REST API without proper sanitization; the REST API bypasses the sanitize_hex_color() filter applied by the classic editor. As a result, unsanitized meta values are later concatenated into CSS strings and output through wp_add_inline_style without any escaping, allowing an authenticated user with Contributor or higher role to inject arbitrary JavaScript. This stored XSS flaw will execute client‑side whenever a visitor loads the affected post or page, potentially compromising the integrity of site content.

Affected Systems

WordPress installations using the Zakra theme version 4.2.0 or older are vulnerable; the flaw originates from the theme's REST API configuration and is specific to ThemeGrill's Zakra product.

Risk and Exploitability

The CVSS score of 6.4 denotes moderate severity, while an EPSS score of less than 1% indicates a low probability of exploitation at present, and the vulnerability is not listed in the CISA KEV catalog. Attackers must first possess Contributor or higher permissions to inject payloads via the REST API; once injected, the malicious code runs in the browsers of any user who views the modified page.

Generated by OpenCVE AI on July 21, 2026 at 10:03 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update the Zakra theme to version 4.2.1 or later to remove the vulnerable meta registrations and add proper sanitization.
  • Limit the use of Contributor and higher roles to trusted users only, reducing the number of accounts able to inject scripts.
  • Implement a Content Security Policy that blocks inline scripts and restricts script sources to mitigate the impact if an injection occurs.

Generated by OpenCVE AI on July 21, 2026 at 10:03 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 06 Jul 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 03 Jul 2026 11:00:00 +0000

Type Values Removed Values Added
First Time appeared Themegrill
Themegrill zakra
Wordpress
Wordpress wordpress
Vendors & Products Themegrill
Themegrill zakra
Wordpress
Wordpress wordpress

Fri, 03 Jul 2026 09:00:00 +0000

Type Values Removed Values Added
Description The Zakra theme for WordPress is vulnerable to Stored Cross-Site Scripting via post meta values in all versions up to, and including, 4.2.0. This is due to the theme registering three post meta fields (zakra_menu_item_color, zakra_menu_item_hover_color, and zakra_menu_item_active_color) with 'show_in_rest' => true and 'auth_callback' => '__return_true', but without any sanitize_callback parameter in the register_post_meta() calls. While the classic editor save path applies sanitize_hex_color() sanitization, the REST API path completely bypasses this protection. The unsanitized meta values are then retrieved via get_post_meta() and concatenated directly into CSS strings that are output through wp_add_inline_style() without any escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the injected page.
Title Zakra <= 4.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Meta REST API
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 6.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N'}

Subscriptions

Themegrill Zakra
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-07-06T16:25:45.616Z

Reserved: 2026-03-25T11:38:39.477Z

Link: CVE-2026-4804

cve-icon Vulnrichment

Updated: 2026-07-06T16:25:41.748Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-21T10:15:02Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')