CVE-2026-15463

Received Received - Intake

Reflected Cross-Site Scripting in SSL Zen WordPress Plugin

Publication date: 2026-09-19

Last updated on: 2026-09-19

Assigner: Wordfence

Description

The SSL Zen — SSL Certificate Installer & HTTPS Redirects plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'host' parameter in all versions up to, and including, 4.7.42 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. The vulnerability is only exploitable when in the system_requirements stage.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-19

Last Modified

2026-09-19

Generated

2026-09-20

AI Q&A

2026-09-20

EPSS Evaluated

N/A

NVD

CVE-2026-15463

Affected Vendors & Products

Vendor	Product	Version / Range
ssl_zen	ssl_certificate_installer	to 4.7.42 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This vulnerability is a Reflected Cross-Site Scripting (XSS) issue in the SSL Zen plugin for WordPress. It occurs due to insufficient input sanitization and output escaping in the 'host' parameter, allowing attackers to inject malicious scripts into web pages. The flaw is exploitable only during the system_requirements stage and requires user interaction, such as clicking a malicious link.

Detection Guidance

This vulnerability can be detected by checking if the SSL Zen plugin version 4.7.42 or lower is installed on your WordPress site. Inspect network traffic for reflected XSS attempts targeting the 'host' parameter during the system_requirements stage.

Impact Analysis

An attacker could trick you into clicking a link that executes malicious scripts in your browser. This could lead to session hijacking, stealing cookies, or performing actions on your behalf without your knowledge. It may also allow the attacker to deface websites or redirect you to phishing pages.

Compliance Impact

This vulnerability could lead to unauthorized access to user data, violating GDPR's data protection principles or HIPAA's security requirements for protected health information. Organizations using the vulnerable plugin may face compliance breaches, legal penalties, or reputational damage if exploited.

Mitigation Strategies

Immediately update the SSL Zen plugin to the latest version beyond 4.7.42. If an update is unavailable, consider disabling or removing the plugin until a patch is released. Monitor for suspicious activity related to XSS attempts.

Hi! I’m here to help you understand CVE-2026-15463. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70