Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-09-25
Ssl Zen - Security Vulnerability (CVE-2026-17577)
The SSL Zen plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'uri' (and 'host') parameters in versions up to, and including, 4.7.42. The ssl_zen_messages::getMessages() function builds the 'token_missmatch' message using base64_decode(sanitize_text_field($_REQUEST['uri'])) and (optionally) base64_decode(sanitize_text_field($_REQUEST['host'])). sanitize_text_field() cannot strip HTML/JavaScript that is hidden inside a base64-encoded blob, and the resulting decoded raw HTML is echoed unescaped by showMessage() . This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking…
PLUGIN
Ssl Zen
CVE-2026-17577
Risk Score
Threat Entry
Updated 2026-09-25
Ssl Zen - Security Vulnerability (CVE-2026-17602)
The SSL Zen — SSL Certificate Installer & HTTPS Redirects plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.7.42 via the 'file_name' parameter parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
PLUGIN
Ssl Zen
CVE-2026-17602
Risk Score
Threat Entry
Updated 2026-09-21
Ssl Zen - Security Vulnerability (CVE-2026-15463)
The SSL Zen — SSL Certificate Installer & HTTPS Redirects plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'host' parameter in all versions up to, and including, 4.7.42 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. The vulnerability is only exploitable when in the system_requirements stage.
PLUGIN
Ssl Zen
CVE-2026-15463
Risk Score
Threat Entry
Updated 2026-09-11
SSL Zen - Cross-Site Request Forgery (CSRF) (CVE-2026-86781)
The SSL Zen — SSL Certificate Installer & HTTPS Redirects WordPress plugin before 4.7.40 does not perform capability or nonce checks on a certificate-file download routine that runs early in the WordPress admin request lifecycle, allowing any authenticated user, including Subscribers, to download the site's TLS private key, certificates, and diagnostic logs.
PLUGIN
SSL Zen
CVE-2026-86781
Risk Score
Threat Entry
Updated 2026-10-22
SSL Zen - Cross-Site Scripting (XSS) (CVE-2026-28569)
Unauthenticated Cross Site Scripting (XSS) in SSL Zen
PLUGIN
SSL Zen
CVE-2026-28569
Risk Score
Threat Entry
Updated 2026-06-17
Ssl Zen - Security Vulnerability (CVE-2024-1076)
The SSL Zen WordPress plugin before 4.6.0 does not properly prevent directory listing of the private keys folder, as it only relies on the use of .htaccess to prevent visitors from accessing the site's generated private keys, which allows an attacker to read them if the site runs on a server who doesn't support .htaccess files, like NGINX.
PLUGIN
Ssl Zen
CVE-2024-1076
Risk Score