Skip to content
OpenAdvisories

Product · ThemeGrill

Zakra

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 6.4
    CVE-2026-4804

    Zakra <= 4.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Meta REST API

    The Zakra theme for WordPress is vulnerable to Stored Cross-Site Scripting via post meta values in all versions up to, and including, 4.2.0. This is due to the theme registering three post meta fields (zakra_menu_item_color, zakra_menu_item_hover_color, and z…

    ThemeGrill Zakra Web / CMS
  • Medium 4.3
    CVE-2025-8595

    Zakra <= 4.1.5 - Missing Authorization to Subscriber+ Demo Import

    The Zakra theme for WordPress is vulnerable to unauthorized data modification due to a missing capability check on the welcome_notice_import_handler() function in all versions up to, and including, 4.1.5. This makes it possible for authenticated attackers, wi…

    ThemeGrill Zakra Web / CMS