CVE-2025-13512 is a reflected cross-site scripting vulnerability in the CoSign Single Signon WordPress plugin by jiangxin. The issue is caused by improper neutralization of input during web page generation, specifically via the $_SERVER['PHP_SELF'] parameter. This allows attackers to inject malicious scripts that execute in the context of a victim's browser if they click a crafted link. The vulnerability affects all versions up to and including 0.3.1. The CVSS 3.1 base score is 6.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity.

Successful exploitation can lead to execution of arbitrary scripts in the context of the victim's browser, potentially resulting in information disclosure or manipulation of user interactions within the affected site. The vulnerability requires user interaction (clicking a malicious link) and does not grant direct system access or availability impact. There are no known exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or removing the affected plugin version or applying manual input sanitization and output escaping if feasible. Monitor official vendor channels for updates regarding patches or mitigations.