SSL Zen
Avoid: vulnerability published 17 Aug 2026 still has no fix after 14 days.
Based on 3 of 5 areas
Capped at 39: a vulnerability has no patch.
| Ownership | 100 |
|---|---|
| Maintenance | 100 |
| Security | 15 |
| Support | No data |
| Reputation | No data |
Quick answers
- Is SSL Zen still maintained?
- Yes. Last release 18 Sep 2026, 16 releases in the last 24 months. 18 Sep 2026 · wordpress.org
- Who owns SSL Zen, and has it changed hands?
- No change recorded. Main committer sslzen since Feb 2019. 3 Nov 2026 · SVN log
- Was SSL Zen removed from wordpress.org?
- No. Listed on wordpress.org as of 3 Nov 2026. 3 Nov 2026 · wordpress.org
- Is SSL Zen safe?
- No. 1 known vulnerability has no fix in the current version. 24 Sep 2026 · Wordfence Intelligence
- Is the latest SSL Zen update safe to install?
- No ownership change before 4.7.43. No one-star spike after it. 18 Sep 2026 · Release history
Active signals
Facts we detected, with links to the source.
- CriticalSEC-2Vulnerability published 17 Aug 2026 still has no fix after 14 days. Disable or replace the plugin. No fix has been released.31 Aug 2026Evidence
Ownership timeline
Who commits to the plugin's code on wordpress.org, over time.
| plugin-master | 20 Feb 2019 to 20 Feb 2019, 1 commits |
|---|---|
| sslzen | 22 Feb 2019 to 18 Sep 2026, 227 commits |
2 committers recorded. No ownership change since 2019.
Maintenance
- Last release
- 47 days ago
- Releases, 24 months
- 16
- Tested up to
- 7.0 vs 7.1
- Requires PHP
- 5.6 supported 8.2+
| Q1 2024 | 0 |
|---|---|
| Q2 2024 | 0 |
| Q3 2024 | 1 |
| Q4 2024 | 0 |
| Q1 2025 | 0 |
| Q2 2025 | 0 |
| Q3 2025 | 0 |
| Q4 2025 | 2 |
| Q1 2026 | 0 |
| Q2 2026 | 0 |
| Q3 2026 | 14 |
| Q4 2026 | 0 |
Last release 18 Sep 2026. Tested up to 7.0, 1 major version behind WordPress 7.1.
Reputation
Last 90 days: no reviews. Lifetime: 4.9.
| 5 star | 638 |
|---|---|
| 4 star | 8 |
| 3 star | 5 |
| 2 star | 4 |
| 1 star | 10 |
Security record
5 vulnerabilities in 24 months (8 on record), 1 with no fix in the current version.
| Published | Issue | CVSS | Affected | Fixed in | Days to patch |
|---|---|---|---|---|---|
| 17 Aug 2026 | SSL Zen - SSL Certificate Installer & HTTPS Redirects <= 4.7.43 - Reflected Cross-Site Scripting | 6.1 | <= 4.7.43 | No fix | n/a |
Show 7 patched vulnerabilities
| Published | Issue | CVSS | Affected | Fixed in | Days to patch |
|---|---|---|---|---|---|
| 24 Sep 2026 | SSL Zen <= 4.7.42 - Authenticated (Administrator+) Path Traversal to Arbitrary File Read via 'file_name' Parameter | 4.9 | <= 4.7.42 | 4.7.43 | Patched before disclosure |
| 24 Sep 2026 | SSL Zen <= 4.7.42 - Reflected Cross-Site Scripting via 'uri' Parameter | 6.1 | <= 4.7.42 | 4.7.43 | Patched before disclosure |
| 18 Sep 2026 | SSL Zen <= 4.7.42 - Reflected Cross-Site Scripting via 'uri' and 'host' Parameters | 6.1 | <= 4.7.42 | 4.7.43 | Patched before disclosure |
| 11 Sep 2026 | SSL Zen - SSL Certificate Installer & HTTPS Redirects < 4.7.40 - Authenticated (Subscriber+) Information Exposure | 4.3 | < 4.7.40 | 4.7.40 | Patched before disclosure |
| 17 Apr 2024 | SSL Zen - Free Let's Encrypt SSL Certificate & HTTPS/SSL Redirect WordPress Plugin <= 4.5.0 - Sensitive Information Exposure | 5.3 | <= 4.5.0 | 4.6.0 | n/a |
| 18 Jul 2023 | Freemius SDK <= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get | 6.1 | <= 4.5.2 | 4.5.3 | n/a |
| 4 Mar 2022 | Freemius SDK <= 2.4.2 - Missing Authorization Checks | 6.3 | <= 4.0.4 | 4.0.5 | n/a |
Changelog mentions of security fixes: 4.7.40 (security, nonce); 4.7.43 (security, XSS, escaping).
Sources: Wordfence Intelligence, CISA Known Exploited Vulnerabilities, readme changelogs.
Support
Support history appears after our first snapshots of the forum counts.
Momentum
9,000+ active installs. History builds with each weekly snapshot.
| 4 May 2026 | 134 |
|---|---|
| 11 May 2026 | 382 |
| 18 May 2026 | 330 |
| 25 May 2026 | 338 |
| 1 Jun 2026 | 285 |
| 8 Jun 2026 | 313 |
| 15 Jun 2026 | 266 |
| 22 Jun 2026 | 290 |
| 29 Jun 2026 | 666 |
| 6 Jul 2026 | 10,266 |
| 13 Jul 2026 | 2,253 |
| 20 Jul 2026 | 676 |
| 27 Jul 2026 | 793 |
| 3 Aug 2026 | 643 |
| 10 Aug 2026 | 472 |
| 17 Aug 2026 | 473 |
| 24 Aug 2026 | 472 |
| 31 Aug 2026 | 524 |
| 7 Sep 2026 | 594 |
| 14 Sep 2026 | 4,305 |
| 21 Sep 2026 | 1,265 |
| 28 Sep 2026 | 762 |
| 5 Oct 2026 | 659 |
| 12 Oct 2026 | 554 |
| 19 Oct 2026 | 708 |
| 26 Oct 2026 | 581 |
| 2 Nov 2026 | 87 |
Weekly downloads over the last 4 weeks are 55% below the 27-week average.
Healthier alternatives
Same job, rated Healthy, higher Canary Score and at least 10,000 installs. Never sponsored.
Facts
| Version | 4.7.43 |
|---|---|
| Author | SSL Zen - Free SSL/HTTPS |
| Added | 22 Feb 2019 |
| Last updated | 18 Sep 2026 |
| Active installs | 9,000+ |
| Requires WordPress | 4.2 |
| Tested up to | 7.0.8 |
| Requires PHP | 5.6 |
| Category | Security & Privacy > SSL & HTTPS Management |
| Tags | ssl, free ssl, force ssl, mixed content, ssl certificate |
Other plugins by this author: 404Zen - Broken Link Fixer & Monitor
Questions
Is SSL Zen still maintained?
Yes. Last release 18 Sep 2026, 16 releases in the last 24 months.
Who owns SSL Zen, and has it changed hands?
No change recorded. Main committer sslzen since Feb 2019.
Was SSL Zen removed from wordpress.org?
No. Listed on wordpress.org as of 3 Nov 2026.
Is SSL Zen safe?
No. 1 known vulnerability has no fix in the current version.
Is the latest SSL Zen update safe to install?
No ownership change before 4.7.43. No one-star spike after it.