WordPress plugin
SSL Zen — SSL Certificate Installer & HTTPS Redirects security & vulnerabilities
Unpatched vulnerability in the latest version
At least one vulnerability affects the latest version and no fix has been released. Deactivate the plugin or restrict access to the affected feature until the vendor ships a patch.
- Critical0
- High0
- Medium8
- Low0
All SSL Zen — SSL Certificate Installer & HTTPS Redirects vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| Medium4.9 | Authenticated (Administrator+) Path Traversal to Arbitrary File Read via 'file_name' Parameter ≤4.7.42Update to 4.7.43 | CVE-2026-17602 | |
| Medium6.1 | Reflected Cross-Site Scripting via 'uri' Parameter ≤4.7.42Update to 4.7.43 | CVE-2026-17577 | |
| Medium6.1 | Reflected Cross-Site Scripting via 'uri' and 'host' Parameters ≤4.7.42Update to 4.7.43 | CVE-2026-15463 | |
| Medium4.3 | Authenticated (Subscriber+) Information Exposure <4.7.40Update to 4.7.40 | CVE-2026-86781 | |
| Medium6.1 | Reflected Cross-Site Scripting ≤4.7.43No patch available | CVE-2026-28569 | |
| Medium5.3 | Sensitive Information Exposure ≤4.5.0Update to 4.6.0 | CVE-2024-1076 | |
| Medium6.1 | Reflected Cross-Site Scripting via fs_request_get ≤1.9.2No patch available | CVE-2023-33999 | |
| Medium6.3 | Missing Authorization Checks all versionsNo patch available | CVE-2022-4974 |
- Medium4.9Authenticated (Administrator+) Path Traversal to Arbitrary File Read via 'file_name' Parameter
≤4.7.42Update to 4.7.43
- Medium6.1Reflected Cross-Site Scripting via 'uri' Parameter
≤4.7.42Update to 4.7.43
- Medium6.1Reflected Cross-Site Scripting via 'uri' and 'host' Parameters
≤4.7.42Update to 4.7.43
- Medium4.3Authenticated (Subscriber+) Information Exposure
<4.7.40Update to 4.7.40
- Medium6.1Reflected Cross-Site Scripting
≤4.7.43No patch available
- Medium5.3Sensitive Information Exposure
≤4.5.0Update to 4.6.0
- Medium6.1Reflected Cross-Site Scripting via fs_request_get
≤1.9.2No patch available
- Medium6.3Missing Authorization Checks
all versionsNo patch available
SSL Zen — SSL Certificate Installer & HTTPS Redirects: common questions
Does SSL Zen — SSL Certificate Installer & HTTPS Redirects have known vulnerabilities?
Yes. VulnCrest Radar lists 8 known vulnerabilities in SSL Zen — SSL Certificate Installer & HTTPS Redirects: 8 medium. At least one is not fixed in the latest version.
How do I check which version of SSL Zen — SSL Certificate Installer & HTTPS Redirects I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent SSL Zen — SSL Certificate Installer & HTTPS Redirects vulnerability?
CVE-2026-17602, published Sep 24, 2026: SSL Zen <= 4.7.42 - Authenticated (Administrator+) Path Traversal to Arbitrary File Read via 'file_name' Parameter. Severity: Medium (CVSS 4.9).
Is any SSL Zen — SSL Certificate Installer & HTTPS Redirects vulnerability listed in CISA KEV?
No. None of the known SSL Zen — SSL Certificate Installer & HTTPS Redirects vulnerabilities is currently listed in the CISA KEV catalog.