CVE-2026-4804
Received Received - Intake

Stored XSS in Zakra WordPress Theme

Publication date: 2026-07-03

Last updated on: 2026-07-03

Assigner: Wordfence

Description
The Zakra theme for WordPress is vulnerable to Stored Cross-Site Scripting via post meta values in all versions up to, and including, 4.2.0. This is due to the theme registering three post meta fields (zakra_menu_item_color, zakra_menu_item_hover_color, and zakra_menu_item_active_color) with 'show_in_rest' => true and 'auth_callback' => '__return_true', but without any sanitize_callback parameter in the register_post_meta() calls. While the classic editor save path applies sanitize_hex_color() sanitization, the REST API path completely bypasses this protection. The unsanitized meta values are then retrieved via get_post_meta() and concatenated directly into CSS strings that are output through wp_add_inline_style() without any escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the injected page.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-03
Last Modified
2026-07-03
Generated
2026-07-03
AI Q&A
2026-07-03
EPSS Evaluated
N/A
NVD
CVE-2026-4804
EUVD
EUVD-2026-41523

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
themeisle zakra to 4.2.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Zakra theme for WordPress has a Stored Cross-Site Scripting (XSS) vulnerability in all versions up to and including 4.2.0. This occurs because three post meta fields (zakra_menu_item_color, zakra_menu_item_hover_color, and zakra_menu_item_active_color) are registered with the REST API enabled and an authorization callback that always returns true, but without any sanitization callback.

While the classic editor sanitizes these color values, the REST API path does not, allowing attackers with Contributor-level access or higher to inject malicious scripts. These scripts are stored in post meta values and then output directly into CSS strings without escaping, causing the injected scripts to execute whenever a user views the affected page.

Impact Analysis

This vulnerability allows authenticated users with Contributor-level access or above to inject arbitrary JavaScript into pages via post meta fields. When other users visit these pages, the malicious scripts execute in their browsers.

The impact includes potential theft of user credentials, session hijacking, defacement of the website, or redirection to malicious sites. Because the vulnerability is exploitable remotely and requires only low privileges, it poses a significant risk to site integrity and user security.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-4804. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart