The vulnerability is an unauthenticated Cross‑Site‑Scripting (XSS) flaw in SSL Zen plugin versions 4.7.43 and earlier. The flaw allows an attacker to inject malicious script code into responses that are reflected back to browsers. If an end‑user visits a crafted URL, the injected script runs with the privileges of that user, which could lead to session hijacking, credential theft, or defacement of the site.

All WordPress sites that have the SSL Zen plugin installed in any release up to 4.7.43 are affected. The plugin is distributed as a WordPress plugin under the vendor name SSL Zen. No specific sub‑versions beyond the major release were identified.

The CVSS score of 7.1 indicates a moderate‑to‑high severity vulnerability. While the EPSS score is not available, the absence of a KEV listing does not preclude exploitation. The flaw is unauthenticated and can be triggered via a normal HTTP request containing malicious input, making it widely exploitable. Attackers do not require privileged access or special configuration; simply visiting a crafted URL can exercise the reflected XSS.