PT-2025-49214 · WordPress · Cosign Single Signon

Abdulsamad Yusuf · Published 2025-12-05 · Updated 2025-12-05 · CVE-2025-13512

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions CoSign Single Signon plugin for WordPress versions up to and including 0.3.1

Description The CoSign Single Signon plugin for WordPress is susceptible to Reflected Cross-Site Scripting due to inadequate input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts into pages, potentially executing if a user is tricked into performing an action like clicking a malicious link. The vulnerability is related to the $ SERVER['PHP SELF'] parameter.

Recommendations Update the CoSign Single Signon plugin to a version newer than 0.3.1.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-13512

Affected Products

Cosign Single Signon

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-13512 · Security Note
• https://t.me/CVEtracker/38896 · Telegram Post
• https://plugins.trac.wordpress.org/browser/cosign-sso/tags/0.3.1/cosign-sso.php#L423 · Note
• https://plugins.trac.wordpress.org/browser/cosign-sso/trunk/cosign-sso.php#L423 · Note
• https://twitter.com/CVEnew/status/1996841713902800960 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/0bbeab52-59a9-4d8d-8e3e-ebcbbca9816b?source=cve · Note
• https://twitter.com/VulmonFeeds/status/1996907616585298244 · Twitter Post