CVE-2026-4804

Name of the Vulnerable Software and Affected Versions Zakra versions prior to 4.2.1

Description The Zakra theme for WordPress contains a Stored Cross-Site Scripting issue. This occurs because the theme registers three post meta fields—zakra menu item color, zakra menu item hover color, and zakra menu item active color—with the REST API enabled and an authentication callback that returns true, but lacks a sanitize callback parameter in the register post meta() function. While the classic editor uses sanitize hex color() for sanitization, the REST API path bypasses this protection. The unsanitized values are retrieved via get post meta() and concatenated into CSS strings output through wp add inline style() without escaping. Consequently, authenticated attackers with Contributor-level access or higher can inject arbitrary web scripts into pages that execute when accessed by users.

Recommendations Update to a version newer than 4.2.0.