Executive brief
The SSL Zen plugin for WordPress, which handles SSL certificate installation and HTTPS configuration, contains a reflected cross-site scripting (XSS) vulnerability in the host parameter. An attacker can craft a malicious link that injects arbitrary JavaScript code, which executes in a user's browser if they click the link while in the system requirements stage. This could allow attackers to steal session cookies, redirect users to phishing sites, or perform actions on behalf of the victim.
Technical details
The vulnerability is a reflected XSS flaw caused by insufficient input sanitization and output escaping of the 'host' parameter. The flaw only exists during the system_requirements stage, limiting the attack scope. An unauthenticated attacker can inject malicious scripts through a crafted URL, and the victim's browser executes the JavaScript when the page loads, providing access to session tokens and sensitive data.
Affected products
- Zibnix SSL Zen up to and including 4.7.42
Timeline
- 2026-09-19: disclosed