{"id":"CVE-2026-4804","state":"PUBLISHED","title":"Zakra <= 4.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Meta REST API","description":"The Zakra theme for WordPress is vulnerable to Stored Cross-Site Scripting via post meta values in all versions up to, and including, 4.2.0. This is due to the theme registering three post meta fields (zakra_menu_item_color, zakra_menu_item_hover_color, and zakra_menu_item_active_color) with 'show_in_rest' => true and 'auth_callback' => '__return_true', but without any sanitize_callback parameter in the register_post_meta() calls. While the classic editor save path applies sanitize_hex_color() sanitization, the REST API path completely bypasses this protection. The unsanitized meta values are then retrieved via get_post_meta() and concatenated directly into CSS strings that are output through wp_add_inline_style() without any escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the injected page.","publishedAt":"2026-07-03T07:53:09.987Z","updatedAt":"2026-07-06T16:25:45.616Z","severity":{"score":6.4,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","source":"Wordfence"},"assigner":"Wordfence","products":["themegrill Zakra"],"affected":[{"vendor":"themegrill","product":"Zakra","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"4.2.0","versionType":"semver"}]}],"references":["https://www.wordfence.com/threat-intel/vulnerabilities/id/bbda67a3-0413-4d8e-8157-84c9c87b8695?source=cve","https://themes.trac.wordpress.org/changeset?reponame=&new=330192%40zakra%2F4.2.1&old=297420%40zakra%2F4.2.0#file39"],"weaknesses":["CWE-79"],"ingestedAt":"2026-10-29T20:12:16.098Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/4xxx/CVE-2026-4804.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-4804","state":"PUBLISHED","datePublished":"2026-07-03T07:53:09.987Z","dateUpdated":"2026-07-06T16:25:45.616Z","assignerShortName":"Wordfence","assignerOrgId":"b15e7b5b-3da4-40ae-a43c-f7aa60e62599","dateReserved":"2026-03-25T11:38:39.477Z"},"containers":{"cna":{"title":"Zakra <= 4.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Meta REST API","descriptions":[{"lang":"en","value":"The Zakra theme for WordPress is vulnerable to Stored Cross-Site Scripting via post meta values in all versions up to, and including, 4.2.0. This is due to the theme registering three post meta fields (zakra_menu_item_color, zakra_menu_item_hover_color, and zakra_menu_item_active_color) with 'show_in_rest' => true and 'auth_callback' => '__return_true', but without any sanitize_callback parameter in the register_post_meta() calls. While the classic editor save path applies sanitize_hex_color() sanitization, the REST API path completely bypasses this protection. The unsanitized meta values are then retrieved via get_post_meta() and concatenated directly into CSS strings that are output through wp_add_inline_style() without any escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the injected page."}],"affected":[{"vendor":"themegrill","product":"Zakra","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"4.2.0","versionType":"semver"}]}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bbda67a3-0413-4d8e-8157-84c9c87b8695?source=cve"},{"url":"https://themes.trac.wordpress.org/changeset?reponame=&new=330192%40zakra%2F4.2.1&old=297420%40zakra%2F4.2.0#file39"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","baseScore":6.4,"baseSeverity":"MEDIUM"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-79","lang":"en","description":"CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","type":"CWE"}]}],"providerMetadata":{"shortName":"Wordfence","orgId":"b15e7b5b-3da4-40ae-a43c-f7aa60e62599","dateUpdated":"2026-07-03T07:53:09.987Z"},"credits":[{"lang":"en","type":"finder","value":"Osvaldo Noe Gonzalez Del Rio (Os)"}],"timeline":[{"time":"2026-03-25T11:54:11.000Z","lang":"en","value":"Vendor Notified"},{"time":"2026-07-02T19:01:25.000Z","lang":"en","value":"Disclosed"}]},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-07-06T16:25:36.489784Z","id":"CVE-2026-4804","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-07-06T16:25:45.616Z"}}]}}}