Reflected Cross-Site Scripting Vulnerability in CoSign Single Signon Plugin for WordPress

CVE-2025-13512

What is CVE-2025-13512?

The CoSign Single Signon plugin for WordPress is vulnerable to reflected cross-site scripting (XSS) due to insufficient input sanitization and output escaping. This vulnerability allows attackers to exploit the $_SERVER['PHP_SELF'] parameter in all versions up to and including 0.3.1. If successful, an unauthenticated attacker can inject arbitrary scripts that execute within the context of the user's browser, potentially leading to session hijacking or other malicious activities if the user is persuaded to interact with a malicious link.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References