SSL Zen
by WordPress
CVEs (4)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2026-28569 | Hig | 0.46 | 7.1 | 0.00 | Aug 18, 2026 | Unauthenticated Cross Site Scripting (XSS) in SSL Zen <= 4.7.43 versions. | ||
| CVE-2024-1076 | Med | 0.42 | 6.5 | 0.00 | May 8, 2024 | The SSL Zen WordPress plugin before 4.6.0 does not properly prevent directory listing of the private keys folder, as it only relies on the use of .htaccess to prevent visitors from accessing the site's generated private keys, which allows an attacker to read them if the site… | ||
| CVE-2026-15463 | Med | 0.40 | 6.1 | 0.00 | Sep 19, 2026 | The SSL Zen — SSL Certificate Installer & HTTPS Redirects plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'host' parameter in all versions up to, and including, 4.7.42 due to insufficient input sanitization and output escaping. This makes it… | ||
| CVE-2026-86781 | Med | 0.34 | 5.3 | 0.00 | Sep 11, 2026 | The SSL Zen — SSL Certificate Installer & HTTPS Redirects WordPress plugin before 4.7.40 does not perform capability or nonce checks on a certificate-file download routine that runs early in the WordPress admin request lifecycle, allowing any authenticated user, including… |
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in SSL Zen <= 4.7.43 versions.
- risk 0.42cvss 6.5epss 0.00
The SSL Zen WordPress plugin before 4.6.0 does not properly prevent directory listing of the private keys folder, as it only relies on the use of .htaccess to prevent visitors from accessing the site's generated private keys, which allows an attacker to read them if the site…
- risk 0.40cvss 6.1epss 0.00
The SSL Zen — SSL Certificate Installer & HTTPS Redirects plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'host' parameter in all versions up to, and including, 4.7.42 due to insufficient input sanitization and output escaping. This makes it…
- risk 0.34cvss 5.3epss 0.00
The SSL Zen — SSL Certificate Installer & HTTPS Redirects WordPress plugin before 4.7.40 does not perform capability or nonce checks on a certificate-file download routine that runs early in the WordPress admin request lifecycle, allowing any authenticated user, including…