SSO login & authenticate Wordpress users with JWT token
I don't know why an iframe was suggested to you, but I do see some possibilities for vulnerability.

For your platforms, I would validate server-2-server.

Flow:

If client claims to be logged in ( in JS / has token in local storage), send token to the platform itself.

The receiving endpoint (let's say platform1_showProfile.php) sends a curl-request to the SSO platform in order to validate (and or logout/refresh if expired etc)

For performance reasons, you will want to ask yourself whether 


JWT is only your SSO authentication method while maintaining state on each platform or if you want to go stateless and use the sso-endpoint on each call.
WordPress is the right solution for this. Consider setting up an authentication server with slimframework or neoan3