CVE-2020-6850: Miniorange SAML SP Single Sign On

Medium severity, CVSS 6.1. EPSS: 1.4% chance of exploitation in the next 30 days.

Utilities.php in the miniorange-saml-20-single-sign-on plugin before 4.8.84 for WordPress allows XSS via a crafted SAML XML Response to wp-login.php. This is related to the SAMLResponse and RelayState variables, and the Destination parameter of the samlp:Response XML element.

Affected products

• Miniorange SAML SP Single Sign On: before 4.8.84 (fixed in 4.8.84)

Published 2020-02-17. Last modified 2026-06-17.