SSL Zen CVE-2026-15463

Exploitable only while the SSL Zen plugin is in its 'system_requirements' setup-wizard stage - outside this transient configuration state the vulnerable code path is not reached, which is the primary limiter. Requires no authentication (PR:N) but does require user interaction (UI:R): a logged-in user, typically the administrator running the setup wizard, must click an attacker-supplied link carrying the malicious 'host' parameter. Affects all versions up to and including 4.7.42 of the SSL Zen - SSL Certificate Installer & HTTPS Redirects WordPress plugin.

This is a genuine but modest-severity issue whose real-world risk is materially reduced by two limiting factors that the raw 6.1 CVSS score obscures. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) confirms network vector and no authentication, but requires user interaction (UI:R) - the victim must click an attacker-crafted link. More importantly, the description states exploitation is ONLY possible 'when in the system_requirements stage,' i.e. during the plugin's SSL setup-wizard flow, which is a transient, non-persistent state most production sites are not sitting in. No EPSS score, no CISA KEV listing, and no public exploit were provided in the intelligence - so exploitation status is: no public exploit identified at time of analysis. This is a real-but-low-priority reflected XSS: unauthenticated and easy to trigger technically, but gated by user interaction and a narrow application state, making mass or automated exploitation impractical. No signals conflict; the vendor CVSS is consistent with a client-side reflected XSS.

While a WordPress administrator is running SSL Zen's setup wizard and it is in the system_requirements stage, an attacker sends the admin a crafted link containing a malicious payload in the 'host' parameter. When the admin clicks it, the unsanitized value is reflected into the page and the injected script executes in the admin's browser session, potentially stealing session tokens or performing admin actions. No public proof-of-concept was identified in the provided data.