CVE-2026-17577: SSL Zen <= 4.7.42 - Reflected Cross-Site Scripting via 'uri' Parameter
The SSL Zen plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'uri' (and 'host') parameters in versions up to, and including, 4.7.42. The sslzenmessages::getMessages() function builds the 'tokenmissmatch' message using base64decode(sanitizetextfield($REQUEST['uri'])) and (optionally) base64decode(sanitizetextfield($REQUEST['host'])). sanitizetextfield() cannot strip HTML/JavaScript that is hidden inside a base64-encoded blob, and the resulting decoded raw HTML is echoed unescaped by showMessage() . This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a specially crafted link.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
SSL Zen for WordPress versions up to and including 4.7.42 are affected. The issue is in request parameters processed by the plugin's message-handling code.
Does an attacker need an account or special privileges?
No. The vulnerability can be exploited by an unauthenticated attacker, but exploitation requires convincing a user to perform an action such as clicking a specially crafted link.
What is the likely impact if exploitation succeeds?
An attacker can inject arbitrary script into the affected page in the user's browser. The stated impact includes low confidentiality and integrity impact, with no availability impact.