CVE-2026-28569
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
Unauthenticated Cross Site Scripting (XSS) in SSL Zen versions up to 4.7.43.
Risk Assessment
An attacker can execute malicious script in the victim's browser, potentially leading to session or data theft.
Recommendation
Update SSL Zen to the latest patched version.
Other vulnerabilities in SSL Zen
See all- CVE-2026-17602Medium
The SSL Zen plugin for WordPress is vulnerable to Directory Traversal in all versions up to and including 4.7.42 via the 'file_name' parameter. This allows reading the contents of arbitrary files on the server.
- CVE-2026-17577Medium
The SSL Zen plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'uri' and 'host' parameters in versions up to and including 4.7.42. The getMessages() function decodes base64 input and echoes raw HTML without escaping.
- CVE-2026-86781Medium
The SSL Zen — SSL Certificate Installer & HTTPS Redirects WordPress plugin before 4.7.40 does not perform capability or nonce checks on a certificate-file download routine that runs early in the WordPress admin request lifecycle, allowing any authenticated user, including Subscribers, to download the site's TLS private key, certificates, and diagnostic logs.
Original NVD description (English source)
Unauthenticated Cross Site Scripting (XSS) in SSL Zen <= 4.7.43 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS