Description

The SSL Zen — SSL Certificate Installer & HTTPS Redirects plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'host' parameter in all versions up to, and including, 4.7.42 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. The vulnerability is only exploitable when in the system_requirements stage.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.1",
  "pubDate": "2026-09-19T08:16:52.627Z",
  "pubdate": "2026-09-19T08:16:52.627Z",
  "executiveSummary": "The SSL Zen plugin for WordPress, in versions up to and including 4.7.42, contains a Reflected Cross-Site Scripting (XSS) vulnerability. This flaw arises from improper sanitization and escaping of user-supplied data within the 'host' parameter. An unauthenticated attacker can leverage this vulnerability to execute arbitrary JavaScript in the context of a victim's browser session. Successful exploitation requires the attacker to trick a logged-in user into interacting with a malicious link, specifically targeting the system_requirements stage of the plugin. The primary risk involves session hijacking, unauthorized actions performed on behalf of the user, and the potential for site-wide administrative compromise if the victim possesses high-level privileges. This vulnerability exposes the application to client-side attacks, potentially leading to unauthorized data exposure or malicious redirection.",
  "technicalDetails": "The vulnerability resides within the request handling logic of the SSL Zen plugin, specifically during the system_requirements stage. The application fails to adequately sanitize the 'host' HTTP GET parameter before rendering it back to the end-user in the HTTP response. Because the application reflects this input directly into the HTML document without appropriate output encoding or sanitization, it is susceptible to reflected XSS attacks.\nThe attack vector necessitates that an attacker crafts a malicious URL containing a payload within the 'host' parameter, such as a script tag or an event handler (e.g., 'host=<script>alert(document.cookie)</script>'). When a victim, such as a WordPress administrator, clicks this link, their browser sends the malicious payload to the server. The plugin processes the request and embeds the payload directly into the server response, which the victim's browser then executes because it interprets the payload as legitimate code belonging to the site origin.\nExploitation is constrained to the 'system_requirements' execution path within the plugin. The lack of proper input validation on the 'host' parameter constitutes the root cause. Since the reflection occurs within the victim's browser session, the malicious script inherits the victim's authentication context and permissions. This allows the attacker to potentially exfiltrate sensitive data, such as session cookies, CSRF tokens, or personal information. Furthermore, if the victim is an administrator, the attacker may perform unauthorized actions, such as modifying plugin settings, injecting additional malicious scripts, or modifying site content.\nThis vulnerability is classified as unauthenticated, as no prior login or access is required to initiate the crafted request. The impact is limited to the client side, as the server does not persist the malicious input (unlike stored XSS), but the security implications remain high due to the potential for administrative account takeover. Mitigation requires implementing robust output escaping and input validation practices within the plugin code, specifically ensuring that all user-supplied data is contextually encoded for HTML output."
}