EUVD-2026-41523
GHSA-vwhw-cgc3-f4mh
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Network REST API vector, no special conditions, Contributor authentication required, scope changes to victim browser; no availability impact.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Zakra theme for WordPress is vulnerable to Stored Cross-Site Scripting via post meta values in all versions up to, and including, 4.2.0. This is due to the theme registering three post meta fields (zakra_menu_item_color, zakra_menu_item_hover_color, and zakra_menu_item_active_color) with 'show_in_rest' => true and 'auth_callback' => '__return_true', but without any sanitize_callback parameter in the register_post_meta() calls. While the classic editor save path applies sanitize_hex_color() sanitization, the REST API path completely bypasses this protection. The unsanitized meta values are then retrieved via get_post_meta() and concatenated directly into CSS strings that are output through wp_add_inline_style() without any escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the injected page.
AnalysisAI
Stored Cross-Site Scripting in the Zakra WordPress theme (versions up to and including 4.2.0) allows authenticated Contributors to inject arbitrary JavaScript into site pages via the REST API. The vulnerability stems from a sanitization bypass: while the classic editor code path correctly applies sanitize_hex_color() to three menu-color post meta fields, the REST API registration omits any sanitize_callback, permitting unfiltered values to be written. Those values are later concatenated unsanitized into inline CSS and rendered on every page load, triggering stored XSS against any site visitor. No active exploitation (CISA KEV) is confirmed; a vendor-released patch is available in version 4.2.1.
Technical ContextAI
The affected product is the Zakra theme by ThemeGrill (CPE: cpe:2.3:a:themegrill:zakra:*:*:*:*:*:*:*:*), a free WordPress theme distributed via the official themes repository. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation). Specifically, three post meta keys - zakra_menu_item_color, zakra_menu_item_hover_color, and zakra_menu_item_active_color - are registered with register_post_meta() using 'show_in_rest' => true and 'auth_callback' => '__return_true' but without a sanitize_callback parameter. WordPress applies registered sanitize_callbacks on both classic editor and REST API writes; without one, REST API write paths receive no sanitization. The sanitized classic-editor path calls sanitize_hex_color(), which enforces valid hex color format. The unsanitized values are later retrieved via get_post_meta() and directly concatenated into CSS rule strings passed to wp_add_inline_style(), which outputs them into the page HTML without escaping, completing the stored XSS sink.
RemediationAI
Upgrade the Zakra theme to version 4.2.1 or later, which is confirmed to contain the fix per the WordPress themes Trac changeset (https://themes.trac.wordpress.org/changeset?reponame=&new=330192%40zakra%2F4.2.1&old=297420%40zakra%2F4.2.0). The fix should add a sanitize_callback (such as sanitize_hex_color) to the register_post_meta() calls for the three affected fields to enforce validation on the REST API write path. If an immediate upgrade is not possible, administrators should restrict the Contributor role to only fully trusted users, effectively raising the minimum privilege threshold for exploitation. Alternatively, a Web Application Firewall rule blocking REST API writes to the zakra_menu_item_color, zakra_menu_item_hover_color, and zakra_menu_item_active_color post meta keys can serve as a compensating control, though this may break legitimate theme color customization via the block editor. The Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/bbda67a3-0413-4d8e-8157-84c9c87b8695 should be consulted for additional remediation guidance.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today