The SSL Zen WordPress plugin handles incoming data through the 'uri' (and 'host') query parameters by base64‑decoding sanitized text and then echoing the raw output without further escaping. This flaw enables attackers to inject arbitrary JavaScript that will run on any page where the message is displayed, violating the integrity of the site’s content. The vulnerability is a classic reflected XSS (CWE‑79) and can be leveraged by simply clicking a crafted link, exposing end‑users to script execution, potential credential theft, or defacement.

All installations of the SSL Zen plugin for WordPress that are running version 4.7.42 or earlier. The vulnerability affects all WordPress sites that have the plugin enabled, regardless of the theme or other plugins installed.

The CVSS score of 6.1 indicates a moderate impact assessment. Because the attack vector is simple – a forged URL containing a base64‑encoded malicious payload – and the vulnerability is public and unauthenticated, the likelihood of exploitation is significant for any site with the plugin active. The EPSS score is not available, and the flaw is not currently listed in CISA’s KEV catalog, though the vulnerability remains exploitable by any user who follows a malicious link.