CVE-2026-17577
MediumCVSS 6.1Summary
The SSL Zen plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'uri' and 'host' parameters in versions up to and including 4.7.42. The getMessages() function decodes base64 input and echoes raw HTML without escaping.
Risk Assessment
An unauthenticated attacker can inject arbitrary web scripts that execute if a user is tricked into clicking a specially crafted link.
Recommendation
Update the SSL Zen plugin to a version newer than 4.7.42 that fixes the Reflected XSS vulnerability in the 'uri' and 'host' parameters.
Other vulnerabilities in SSL Zen
See all- CVE-2026-17602Medium
The SSL Zen plugin for WordPress is vulnerable to Directory Traversal in all versions up to and including 4.7.42 via the 'file_name' parameter. This allows reading the contents of arbitrary files on the server.
- CVE-2026-86781Medium
The SSL Zen — SSL Certificate Installer & HTTPS Redirects WordPress plugin before 4.7.40 does not perform capability or nonce checks on a certificate-file download routine that runs early in the WordPress admin request lifecycle, allowing any authenticated user, including Subscribers, to download the site's TLS private key, certificates, and diagnostic logs.
- CVE-2026-28569High
Unauthenticated Cross Site Scripting (XSS) in SSL Zen versions up to 4.7.43.
Original NVD description (English source)
The SSL Zen plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'uri' (and 'host') parameters in versions up to, and including, 4.7.42. The ssl_zen_messages::getMessages() function builds the 'token_missmatch' message using base64_decode(sanitize_text_field($_REQUEST['uri'])) and (optionally) base64_decode(sanitize_text_field($_REQUEST['host'])). sanitize_text_field() cannot strip HTML/JavaScript that is hidden inside a base64-encoded blob, and the resulting decoded raw HTML is echoed unescaped by showMessage() . This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a specially crafted link.