SAML Single Sign On – SSO Login, CVE-2020-6850

CVE, Research URL: CVE-2020-6850
Home page URL: Security reports for SAML Single Sign On – SSO Login
Application: SAML Single Sign On – SSO Login
Published on: Feb 17, 2020
Research Description: Utilities.php in the miniorange-saml-20-single-sign-on plugin before 4.8.84 for WordPress allows XSS via a crafted SAML XML Response to wp-login.php. This is related to the SAMLResponse and RelayState variables, and the Destination parameter of the samlp:Response XML element.
Affected versions: max 4.8.84.
Status: vulnerable