{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-13512", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-11-21T18:05:25.470Z", "datePublished": "2025-12-05T05:31:21.382Z", "dateUpdated": "2026-04-08T16:34:55.862Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:34:55.862Z"}, "affected": [{"vendor": "jiangxin", "product": "CoSign Single Signon", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "0.3.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The CoSign Single Signon plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `$_SERVER['PHP_SELF']` parameter in all versions up to, and including, 0.3.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link."}], "title": "CoSign Single Signon <= 0.3.1 - Reflected Cross-Site Scripting via $_SERVER['PHP_SELF']", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/0bbeab52-59a9-4d8d-8e3e-ebcbbca9816b?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/cosign-sso/trunk/cosign-sso.php#L423"}, {"url": "https://plugins.trac.wordpress.org/browser/cosign-sso/tags/0.3.1/cosign-sso.php#L423"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "baseScore": 6.1, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Abdulsamad Yusuf"}], "timeline": [{"time": "2025-12-04T16:39:21.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-12-05T15:22:45.449368Z", "id": "CVE-2025-13512", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-05T15:26:05.524Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-13512", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-05T15:22:45.449368Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-05T15:25:20.440Z"}}], "cna": {"title": "CoSign Single Signon <= 0.3.1 - Reflected Cross-Site Scripting via $_SERVER['PHP_SELF']", "credits": [{"lang": "en", "type": "finder", "value": "Abdulsamad Yusuf"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.1, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "jiangxin", "product": "CoSign Single Signon", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "0.3.1"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-12-04T16:39:21.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/0bbeab52-59a9-4d8d-8e3e-ebcbbca9816b?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/cosign-sso/trunk/cosign-sso.php#L423"}, {"url": "https://plugins.trac.wordpress.org/browser/cosign-sso/tags/0.3.1/cosign-sso.php#L423"}], "descriptions": [{"lang": "en", "value": "The CoSign Single Signon plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `$_SERVER['PHP_SELF']` parameter in all versions up to, and including, 0.3.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2025-12-05T05:31:21.382Z"}}}, "cveMetadata": {"cveId": "CVE-2025-13512", "state": "PUBLISHED", "dateUpdated": "2025-12-05T15:26:05.524Z", "dateReserved": "2025-11-21T18:05:25.470Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-12-05T05:31:21.382Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "The CoSign Single Signon plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `$_SERVER['PHP_SELF']` parameter in all versions up to, and including, 0.3.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link."}], "id": "CVE-2025-13512", "lastModified": "2026-04-15T00:35:42.020", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}]}, "published": "2025-12-05T06:16:07.727", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/cosign-sso/tags/0.3.1/cosign-sso.php#L423"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/cosign-sso/trunk/cosign-sso.php#L423"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/0bbeab52-59a9-4d8d-8e3e-ebcbbca9816b?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T20:55:30.067318+00:00", "value": {"mitigation_remediation": ["Update the CoSign Single Signon plugin to a version newer than 0.3.1 to remove the PHP_SELF handling flaw.", "Remove any older copies of the CoSign Single Signon plugin from the wp-content/plugins directory to eliminate residual vulnerability.", "If an immediate update is not feasible, consider disabling or uninstalling the plugin until a patched version is available to prevent the XSS vector from being present in the site\u2019s codebase."], "summary": {"action": "Immediate Patch", "impact": "Reflected Cross\u2011Site Scripting (XSS)"}, "threat_synthesis": {"affected_systems": "The vulnerability affects all installations of the CoSign Single Signon WordPress plugin whose version is 0.3.1 or earlier. The plugin is distributed and maintained by the vendor Jiangxin under the product name CoSign Single Signon. Users who have not upgraded beyond the 0.3.1 release remain susceptible.", "description_and_impact": "The CoSign Single Signon WordPress plugin contains an input handling flaw that fails to escape the value of the PHP_SELF server variable. This oversight allows attackers to embed malicious scripts that are reflected back to the user\u2019s browser when a crafted URL is accessed. Based on the description, it is inferred that an unauthenticated adversary can inject arbitrary JavaScript into pages viewed by a victim who follows a specially crafted link, potentially leading to session hijacking, credential theft, or defacement. The weakness corresponds to the characteristic \"Reflected Cross\u2011Site Scripting\" identified by CWE\u201179.", "risk_and_exploitability": "The flaw carries a CVSS v3.1 score of 6.1, classifying it as moderate in severity. The EPSS score is reported as less than 1 percent, indicating a very low likelihood of exploitation in the wild at present, and the vulnerability is not listed in the CISA KEV catalog. The attack vector requires the victim to load a crafted URL, meaning the threat model relies on social engineering to lure a user into clicking a malicious link. No additional authentication or special privileges are necessary for the exploit to succeed."}}}}, "created": "2025-12-05T10:51:49.761436+00:00", "updated": "2026-04-22T21:00:06.367548+00:00", "vendors": ["jiangxin", "jiangxin$PRODUCT$cosign_single_signon", "wordpress", "wordpress$PRODUCT$wordpress"]}