CVE-2026-4804: Zakra WordPress Theme XSS Vulnerability

CVE-2026-4804 Overview

The Zakra theme for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability [CWE-79] affecting all versions up to and including 4.2.0. The flaw resides in three post meta fields registered without a sanitize_callback: zakra_menu_item_color, zakra_menu_item_hover_color, and zakra_menu_item_active_color. Authenticated attackers with Contributor-level access or above can inject arbitrary JavaScript through the WordPress REST API. The injected payload executes in any visitor's browser when they access affected pages.

Critical Impact
Contributor-level users can inject persistent JavaScript that executes in the browser of every visitor, including administrators, enabling session theft and administrative account takeover.

Affected Products

Zakra WordPress theme versions up to and including 4.2.0
WordPress sites exposing the REST API for post meta updates
Sites permitting Contributor-level user registration or access

Discovery Timeline

2026-07-03 - CVE-2026-4804 published to NVD
2026-07-06 - Last updated in NVD database

Technical Details for CVE-2026-4804

Vulnerability Analysis

The Zakra theme registers three post meta fields intended to store CSS color values for menu customization. Each field is declared with show_in_rest => true and auth_callback => '__return_true', exposing them through the WordPress REST API. The register_post_meta() calls omit the sanitize_callback parameter entirely.

The classic editor save path applies sanitize_hex_color() to incoming values, which restricts input to valid hex color strings. The REST API save path does not invoke this sanitizer. Any string an authenticated user submits via the REST endpoint is persisted verbatim in the postmeta table.

When a page is rendered, the theme calls get_post_meta() to retrieve these values and concatenates them directly into CSS strings passed to wp_add_inline_style(). No output escaping is applied, allowing an attacker to break out of the CSS context and inject <script> tags or execute JavaScript through CSS-based vectors.

Root Cause

The root cause is a missing sanitize_callback in the register_post_meta() calls combined with unescaped output in the CSS generation logic. The theme incorrectly relies on the editor save path for input validation while exposing the same fields through an unsanitized REST API path.

Attack Vector

An authenticated attacker with Contributor privileges sends a POST or PUT request to the WordPress REST API endpoint /wp-json/wp/v2/posts/<id> with a meta object containing malicious payloads in one of the three vulnerable keys. The stored payload executes when any user, including administrators, views the affected post or page. Refer to the Wordfence Vulnerability Report and the WordPress Theme Changeset for the corrective code.

Detection Methods for CVE-2026-4804

Indicators of Compromise

Post meta values in zakra_menu_item_color, zakra_menu_item_hover_color, or zakra_menu_item_active_color containing characters outside the hex color pattern ^#[0-9a-fA-F]{3,8}$.
Rendered pages containing unexpected <script> tags or CSS expression() payloads originating from inline style blocks emitted by the Zakra theme.
REST API access logs showing POST requests to /wp-json/wp/v2/posts/* with a meta field containing the vulnerable keys.

Detection Strategies

Query the wp_postmeta table for the three vulnerable meta_key values and flag any row whose meta_value does not match a valid hex color.
Inspect rendered HTML for inline <style> blocks emitted by wp_add_inline_style() that contain characters such as <, >, ", or script.
Correlate Contributor-level account activity with REST API meta update events to identify low-privileged users writing unusual payloads.

Monitoring Recommendations

Enable WordPress audit logging for REST API meta updates and user role changes.
Monitor creation of new Contributor accounts followed by immediate REST API activity targeting post meta.
Route web server and WordPress logs to a centralized analytics platform for behavioral correlation across authenticated content editing sessions.

How to Mitigate CVE-2026-4804

Immediate Actions Required

Update the Zakra theme to version 4.2.1 or later, which adds the missing sanitization.
Audit wp_postmeta for existing malicious values in the three affected meta keys and remove or normalize them.
Review all Contributor, Author, and Editor accounts, removing untrusted or dormant users.

Patch Information

The vendor addressed the issue in Zakra 4.2.1. The fix is documented in the WordPress Theme Changeset, which adds a sanitize_callback to the register_post_meta() calls and escapes values before they are concatenated into inline CSS.

Workarounds

If patching is not immediately possible, disable the Zakra theme and switch to an unaffected theme.
Restrict REST API access to authenticated administrators using a security plugin or reverse proxy rule until the update is applied.
Temporarily revoke Contributor-and-above capabilities from untrusted users.

bash

# Example: identify suspicious Zakra meta values via WP-CLI
wp db query "SELECT post_id, meta_key, meta_value \
  FROM wp_postmeta \
  WHERE meta_key IN ('zakra_menu_item_color','zakra_menu_item_hover_color','zakra_menu_item_active_color') \
    AND meta_value NOT REGEXP '^#[0-9a-fA-F]{3,8}$';"