CVE-2020-6850

Published: 2020-02-17T16:15Z

Last Modified: 2024-11-21T05:36Z

Source: MITRE CVE List

License: MITRE-CVE-TOS

Utilities.php in the miniorange-saml-20-single-sign-on plugin before 4.8.84 for WordPress allows XSS via a crafted SAML XML Response to wp-login.php. This is related to the SAMLResponse and RelayState variables, and the Destination parameter of the samlp:Response XML element. > MITRE Terms of Use apply – see LICENSE‑MITRE.txt