CVE-2026-4804 is a stored cross-site scripting vulnerability in the Zakra WordPress theme (<=4.2.0). The theme registers three post meta fields (zakra_menu_item_color, zakra_menu_item_hover_color, zakra_menu_item_active_color) with 'show_in_rest' set to true and an authentication callback that always returns true, but lacks a sanitize_callback. While the classic editor sanitizes these values, the REST API path does not, allowing unsanitized input to be stored. These values are then retrieved and concatenated into CSS strings output via wp_add_inline_style() without escaping, enabling authenticated attackers with Contributor-level privileges or higher to inject arbitrary scripts that execute when the page is viewed.

An attacker with Contributor-level or higher privileges can exploit this vulnerability to inject arbitrary JavaScript into pages, leading to cross-site scripting attacks. This can result in session hijacking, defacement, or other malicious actions executed in the context of users viewing the infected pages. The vulnerability does not affect unauthenticated users directly but leverages authenticated user privileges to persist malicious scripts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor-level access to trusted users only. Avoid using the REST API to update the affected post meta fields or sanitize inputs manually before saving. Monitor vendor channels for updates and apply patches promptly once released.