The CoSign Single Signon WordPress plugin contains an input handling flaw that fails to escape the value of the PHP_SELF server variable. This oversight allows attackers to embed malicious scripts that are reflected back to the user’s browser when a crafted URL is accessed. Based on the description, it is inferred that an unauthenticated adversary can inject arbitrary JavaScript into pages viewed by a victim who follows a specially crafted link, potentially leading to session hijacking, credential theft, or defacement. The weakness corresponds to the characteristic "Reflected Cross‑Site Scripting" identified by CWE‑79.

The vulnerability affects all installations of the CoSign Single Signon WordPress plugin whose version is 0.3.1 or earlier. The plugin is distributed and maintained by the vendor Jiangxin under the product name CoSign Single Signon. Users who have not upgraded beyond the 0.3.1 release remain susceptible.

The flaw carries a CVSS v3.1 score of 6.1, classifying it as moderate in severity. The EPSS score is reported as less than 1 percent, indicating a very low likelihood of exploitation in the wild at present, and the vulnerability is not listed in the CISA KEV catalog. The attack vector requires the victim to load a crafted URL, meaning the threat model relies on social engineering to lure a user into clicking a malicious link. No additional authentication or special privileges are necessary for the exploit to succeed.