CVE-2026-17577
Received Received - Intake

Reflected XSS in SSL Zen WordPress Plugin

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: Wordfence

Description
The SSL Zen plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'uri' (and 'host') parameters in versions up to, and including, 4.7.42. The ssl_zen_messages::getMessages() function builds the 'token_missmatch' message using base64_decode(sanitize_text_field($_REQUEST['uri'])) and (optionally) base64_decode(sanitize_text_field($_REQUEST['host'])). sanitize_text_field() cannot strip HTML/JavaScript that is hidden inside a base64-encoded blob, and the resulting decoded raw HTML is echoed unescaped by showMessage() . This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a specially crafted link.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-25
Last Modified
2026-09-25
Generated
2026-09-25
AI Q&A
2026-09-25
EPSS Evaluated
N/A
NVD
CVE-2026-17577
EUVD
EUVD-2026-86593

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
ssl_zen plugin to 4.7.42 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The SSL Zen plugin for WordPress has a reflected Cross-Site Scripting (XSS) vulnerability in versions up to 4.7.42. Attackers can inject malicious scripts via the 'uri' or 'host' parameters by tricking users into clicking a crafted link. The plugin improperly decodes and displays user input without proper escaping.

Detection Guidance

Check for the SSL Zen WordPress plugin version 4.7.42 or lower. Look for unusual script execution in pages where the 'uri' or 'host' parameters are processed. Inspect server logs for base64-encoded strings in these parameters.

Impact Analysis

An attacker could steal cookies, session tokens, or other sensitive data. They might also perform actions on your behalf, redirect you to malicious sites, or deface web pages. Users with admin access are at higher risk as the injected scripts run in their browser context.

Compliance Impact

This vulnerability could lead to unauthorized access to personal data, violating GDPR and HIPAA requirements for data protection. Organizations may face fines or penalties if exploited, as it compromises user privacy and data integrity.

Mitigation Strategies

Update the SSL Zen plugin to the latest version. If an update is unavailable, consider disabling the plugin temporarily. Implement input validation to strip or block base64-encoded malicious payloads in 'uri' and 'host' parameters.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-17577. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart