Known vulnerabilities in SAML Single Sign On – SSO Login

SAML SSO (Single Sign On) for WordPress Login with Okta, Entra ID/Azure AD, GSuite, Salesforce & All SAML IdPs. Free Unlimited SSO [24/7 Support]

9Reported vulnerabilities

9.8Highest CVSS score

5.4.7Latest version

10,000+Active installs

What to do now

Update SAML Single Sign On – SSO Login to 5.4.7 or later. 9 of these have a fixed version available. Updating resolves them.

Plugin last updated: August 14, 2026 / Tested up to WordPress: 7.0.4 / View on wordpress.org

Reported vulnerabilities

Ordered by how urgently they need attention — whether a vulnerability is actually being exploited, and how likely exploitation is, rather than CVSS severity alone.

CVE	Severity	Exploit probability next 30 days	Affected versions	Fixed in	Published
CVE-2020-6850	Medium 6.1	1.4%	Before 4.8.84	`4.8.84`	February 17, 2020
CVE-2026-15013	Critical 9.8	1.5%	0 to 5.4.3 (inclusive)	`5.4.4`	July 16, 2026
CVE-2026-15981	Critical 9.8	0.8%	0 to 5.4.4 (inclusive)	`5.4.5`	July 23, 2026
CVE-2026-61979	Critical 9.8	0.3%	5.4.3 and earlier	`5.4.4`	August 13, 2026
WF-10e49bdd-3a72-4bb7-ba31-21ba4a5b377f	High 8.8	—	4.8.75 and earlier	`4.8.76`	May 20, 2019
CVE-2026-75807	High 7.5	0.3%	0 to 5.4.6 (inclusive)	`5.4.7`	August 29, 2026
CVE-2026-19842	High 7.3	0.2%	4.8.85 to 5.4.6 (inclusive)	`5.4.7`	August 19, 2026
CVE-2022-4496	Medium 6.1	0.6%	16 up to (but not including) 16.0.8	`16.0.8`	January 6, 2023
WF-961cf553-8871-436d-af95-61af963f5e9d	Medium 6.1	—	4.9.20 and earlier	`4.9.21`	June 6, 2022

Sources: vulnerability records from NVD, exploitation from CISA KEV, exploit probability from EPSS. Affected versions come from CPE ranges or from the reporting CNA.