Reflected Cross-Site Scripting Vulnerability in CoSign Single Signon Plugin for WordPress

CVE-2025-13512

What is CVE-2025-13512?

The CoSign Single Signon plugin for WordPress is vulnerable to reflected cross-site scripting (XSS) due to insufficient input sanitization and output escaping. This vulnerability allows attackers to exploit the $_SERVER['PHP_SELF'] parameter in all versions up to and including 0.3.1. If successful, an unauthenticated attacker can inject arbitrary scripts that execute within the context of the user's browser, potentially leading to session hijacking or other malicious activities if the user is persuaded to interact with a malicious link.

References