The SSL Zen — SSL Certificate Installer & HTTPS Redirects plugin for WordPress contains an input validation flaw that allows an unauthenticated attacker to inject arbitrary JavaScript payloads through the 'host' parameter during the system_requirements stage. When a user follows a malicious URL containing an unsanitized 'host' value, the attacker‑supplied code is reflected and executed in the victim’s browser. This represents a Reflected Cross‑Site Scripting (CWE‑79) weakness that can enable attackers to run client‑side code in the context of any user who clicks the link. The impact is confined to the client side and does not affect the server or internal plugin data.

The vulnerability affects the SSL Zen WordPress plugin, version 4.7.42 and earlier. All builds up to and including 4.7.42 are impacted.

The CVSS v3 score of 6.1 indicates moderate severity. The EPSS score of < 1 % shows a very low probability of exploitation at the time of the analysis. The vulnerability is not listed in the CISA KEV catalog. Exploitation can occur if an attacker crafts a URL with a malicious 'host' parameter and a user clicks it while the plugin is in the system_requirements stage; therefore the attack vector relies on user interaction and is limited to client browsers.