CVE-2026-17577 is a reflected cross-site scripting vulnerability in the SSL Zen plugin for WordPress, affecting versions up to 4.7.42. The vulnerability arises from the ssl_zen_messages::getMessages() function, which decodes base64-encoded 'uri' and 'host' parameters after sanitizing with sanitize_text_field(). However, this sanitization does not remove HTML or JavaScript hidden inside the base64-encoded data. The decoded content is then echoed unescaped by showMessage(), enabling injection of arbitrary scripts. This flaw allows unauthenticated attackers to execute scripts in the context of users who interact with maliciously crafted links.

Successful exploitation can lead to execution of arbitrary scripts in the context of the victim's browser, potentially resulting in information disclosure or session hijacking. The vulnerability requires user interaction (clicking a crafted link) and does not require authentication. The CVSS score is 6.1 (medium severity), reflecting the network attack vector, low attack complexity, no privileges required, user interaction needed, and impact on confidentiality and integrity but not availability.

No official patch or fix is currently documented in the provided data. Users should monitor the vendor's advisory for updates. Until a fix is available, avoid clicking on suspicious links related to the affected plugin. Consider disabling or removing the SSL Zen plugin if possible. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.