CVE-2025-12544
Stored Cross-Site Scripting in Multiple WSO2 Products
CVSS Score
4.8
EPSS Score
0.0%
EPSS Percentile
0th
The Publisher portal fails to enforce proper validation on uploaded SVG files, allowing users with the Publisher role to inject malicious scripts. This weakness can be exploited by uploading a crafted SVG file, which is then stored and rendered by the application. The security consequences include the ability for a malicious actor to redirect the victim's browser to an arbitrary website, modify the web page's UI, or retrieve information from the browser. However, the impact is mitigated as session-related sensitive cookies are protected with the httpOnly flag, preventing session hijacking.
| CWE | CWE-79 |
| Vendor | wso2 |
| Product | wso2 api manager |
| Published | Nov 2, 2026 |
Stay Ahead of the Next One
Get instant alerts for wso2 wso2 api manager
Be the first to know when new medium vulnerabilities affecting wso2 wso2 api manager are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None
Affected Versions
WSO2 / WSO2 API Manager
3.2.0 < 3.2.0.449 3.2.1 < 3.2.1.68 4.0.0 < 4.0.0.368 4.1.0 < 4.1.0.60 4.2.0 < 4.2.0.7
WSO2 / WSO2 Carbon API Manager Publisher REST API
0 < 9.28.140