Is CVE-2026-4804 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-4804 being exploited in the wild.

How severe is CVE-2026-4804?

Medium severity, with a CVSS score of 6.4, published 3 July 2026.

Which products and versions are affected?

ThemeGrill Zakra up to, and including, 4.2.0.

Is there a fix for CVE-2026-4804?

A patch was published on 2026-07-03: Version 4.2.1 released to address the issue Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-4804 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-4804?

Check whether you run ThemeGrill Zakra at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-4804: ThemeGrill Zakra Stored XSS via post meta values

CVE-2026-4804 · Severity: medium · CVSS 6.4 · Published 2026-07-03

The Zakra theme for WordPress, a popular design template for websites, contains a security flaw that allows users with basic contributor permissions to inject malicious scripts into pages. This could lead to unauthorized actions being performed in the browser of any visitor who views the affected page, potentially compromising user sessions or redirecting traffic. The issue affects all versions of the theme up to 4.2.0.

Vendors: ThemeGrill.

Quick answers

Is CVE-2026-4804 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-4804 being exploited in the wild.
How severe is CVE-2026-4804?: Medium severity, with a CVSS score of 6.4, published 3 July 2026.
Which products and versions are affected?: ThemeGrill Zakra up to, and including, 4.2.0.
Is there a fix for CVE-2026-4804?: A patch was published on 2026-07-03: Version 4.2.1 released to address the issue Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-4804 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-4804?: Check whether you run ThemeGrill Zakra at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The Zakra theme for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) due to improper sanitization of post meta fields (zakra_menu_item_color, zakra_menu_item_hover_color, and zakra_menu_item_active_color). While the classic editor path uses sanitization, the REST API path bypasses it because the fields are registered with 'show_in_rest' => true and 'auth_callback' => '__return_true' without a 'sanitize_callback'. An authenticated attacker with Contributor-level permissions can submit malicious scripts via the REST API, which are then concatenated into CSS strings and output through wp_add_inline_style() without escaping. The vulnerability is addressed in version 4.2.1.

Affected products

ThemeGrill Zakra up to, and including, 4.2.0

Timeline

2026-07-03: advisory: NVD publication date
2026-07-03: patched: Version 4.2.1 released to address the issue

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.