CVE-2026-4804 Zakra <= 4.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Meta REST API
Authenticated attackers can inject arbitrary scripts via post meta values in the Zakra WordPress theme, leading to stored XSS.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-4804?
CVE-2026-4804 is a medium-severity cross-site scripting vulnerability in themegrill Zakra, published on 3 Jul 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The Zakra theme for WordPress is vulnerable to Stored Cross-Site Scripting via post meta values in all versions up to, and including, 4.2.0. This is due to the theme registering three post meta fields (zakra_menu_item_color, zakra_menu_item_hover_color, and zakra_menu_item_active_color) with 'show_in_rest' => true and 'auth_callback' => '__return_true', but without any sanitize_callback parameter in the register_post_meta() calls. While the classic editor save path applies sanitize_hex_color() sanitization, the REST API path completely bypasses this protection. The unsanitized meta values are then retrieved via get_post_meta() and concatenated directly into CSS strings that are output through wp_add_inline_style() without any escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the injected page.
Weakness: CWE-79
Which versions are affected by CVE-2026-4804?
How do I fix CVE-2026-4804?
No fix has been published for CVE-2026-4804 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-4804 being exploited?
There is no known exploitation of CVE-2026-4804 in the wild and no public exploit code.
Sources
Also known as GHSA-vwhw-cgc3-f4mh.