Medium severity6.1NVD Advisory· Published Jun 24, 2019· Updated Jun 17, 2026

CVE-2019-12346

Description

In the miniOrange SAML SP Single Sign On plugin before 4.8.73 for WordPress, the SAML Login Endpoint is vulnerable to XSS via a specially crafted SAMLResponse XML post.

Affected products

miniOrange/SAML SP Single Sign On plugindescription
WordPress/Miniorange Saml 20 Single Sign Onllm-fuzzy
Range: <4.8.73
Package: https://wordpress.org/plugins/miniorange-saml-20-single-sign-on

Patches

Vulnerability mechanics

References

zeroauth.ltd/blog/2019/05/27/cve-2019-12346-miniorange-saml-sp-single-sign-on-wordpress-plugin-xss/nvdExploitThird Party Advisory
wpvulndb.com/vulnerabilities/9397nvd

News mentions

No linked articles in our index yet.

cvss	0.397
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000