SSL Zen EUVD-2026-86593

Reflected XSS reachable by any unauthenticated attacker over the network against SSL Zen <=4.7.42, with no special plugin configuration required - the token_missmatch code path in ssl_zen_messages::getMessages() processes attacker-supplied 'uri'/'host' request parameters directly. The key LIMITING factor is mandatory user interaction (UI:R): the attacker must trick a victim into clicking a crafted link, so exploitation depends on successful social engineering and cannot be triggered passively. Impact is scoped to the victim's browser session (C:L/I:L), with elevated value if the victim is an authenticated administrator.

This is a reflected XSS (CWE-79) in the SSL Zen WordPress plugin, rated CVSS 6.1 (medium). The vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N indicates network-reachable, low-complexity, unauthenticated exploitation, but it critically REQUIRES user interaction (UI:R) - a victim must click an attacker-crafted link - which caps real-world severity. No EPSS score, no CISA KEV listing, and no public POC are present in the provided data, so there is no signal of active or automated exploitation. No SSVC decision data was supplied. The technical root cause is well-documented and plausible: getMessages() base64_decodes the attacker-controlled 'uri'/'host' parameters after sanitize_text_field(), which cannot strip HTML hidden inside a base64 blob, and showMessage() echoes the decoded raw HTML unescaped. This is a genuine but standard, interaction-gated reflected XSS - a routine-priority patch item, not an emergency; the bounded C:L/I:L/A:N impact and mandatory phishing step keep real-world risk moderate rather than critical.

An attacker crafts a URL to the target WordPress site with a base64-encoded JavaScript payload in the 'uri' (or 'host') parameter and delivers it via phishing, forum post, or malicious ad. When a logged-in administrator or any visitor clicks the link, the token_missmatch message is rendered with the decoded raw HTML, executing the script in their browser session (e.g., stealing cookies or performing actions as that user). No public exploit code is identified at time of analysis, though the vulnerable code path is precisely described in the Wordfence/trac references.