CVE-2026-15463

Overview

The SSL Zen WordPress plugin (up to 4.7.42) contains a reflected XSS flaw in the 'host' parameter during the system_requirements stage. An unauthenticated attacker can inject malicious scripts that execute when a user follows a crafted link. This flaw can lead to defacement, credential theft, or session hijacking.

Description

The SSL Zen — SSL Certificate Installer & HTTPS Redirects plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'host' parameter in all versions up to, and including, 4.7.42 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. The vulnerability is only exploitable when in the system_requirements stage.

Impact

The vulnerability compromises confidentiality, integrity, and availability of the web application by allowing arbitrary script execution. Defenders must protect users from phishing links and prevent unauthorized script injection. Attackers could steal session cookies, deface content, or redirect users to malicious sites.

Remediation

Update SSL Zen to the latest version (≥4.7.43) or remove the plugin if not needed. If an update is unavailable, disable the system_requirements feature or block the 'host' parameter via a web application firewall. Additionally, enforce strict input validation and output escaping on all user-facing pages.

Risk context

Medium severity with a CVSS v3 score of 6.1 and an EPSS of 0.00136 indicates a low probability of exploitation but still warrants prompt attention. Defenders should prioritize patching or disabling the vulnerable plugin to mitigate potential XSS attacks.

Affected products

• WordPress SSL Zen 4.7.42
• WordPress SSL Zen 4.7.41
• WordPress SSL Zen 4.7.40
• WordPress SSL Zen 4.7.39
• WordPress SSL Zen 4.7.38
• WordPress SSL Zen 4.7.37
• WordPress SSL Zen 4.7.36
• WordPress SSL Zen 4.7.35