CVE-2025-4760Authenticated Stored Cross-Site Scripting (XSS) in Multiple WSO2 Products via API Document Upload in Publisher
- 4.8MediumCVSS base score
- 0.19%Exploitation in 30 daysEPSS · top 92% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
An authenticated stored cross-site scripting (XSS) vulnerability exists in multiple WSO2 products due to improper validation of user-supplied input during API document upload in the Publisher portal. A user with publisher privileges can upload a crafted API document containing malicious JavaScript, which is later rendered in the browser when accessed by other users. A successful attack could result in redirection to malicious websites, unauthorized UI modifications, or exfiltration of browser-accessible data. However, session-related sensitive cookies are protected by the httpOnly flag, preventing session hijacking.
Timeline
ID reserved
By WSO2
- 4 months later
· 4 months later
Published
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| WSO2CNA (assigner) | 3.1 | Medium4.8 | CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N |
| NVDNVD · Analyzed | 3.1 | Medium4.8 | CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N |
- EPSS (exploitation in 30 days)
- 0.19% · top 92% of all CVEs (13 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 4.8.
Affected products
- unknown < 3.2.0
- affected 3.2.0 – < 3.2.0.428
- affected 3.2.1 – < 3.2.1.48
- affected 4.1.0 – < 4.1.0.209
- affected 4.2.0 – < 4.2.0.145
- affected 4.3.0 – < 4.3.0.60
- affected 4.4.0 – < 4.4.0.23
- affected 4.5.0 – < 4.5.0.7
- affected 4.5.0 – < 4.5.0.8
- affected 4.5.0 – < 4.5.0.7
- affected 4.5.0 – < 4.5.0.7
WSO2 · WSO2 Carbon API Management API
- affected 6.7.206 – < 6.7.206.559
- affected 6.7.210 – < 6.7.210.48
- affected 9.20.74 – < 9.20.74.365
- affected 9.28.116 – < 9.28.116.321
- affected 9.29.120 – < 9.29.120.163
- affected 9.30.67 – < 9.30.67.80
- affected 9.31.86 – < 9.31.86.30
- unaffected 9.31.117 – ≤ *
Affected packages
From reviewed advisories of the GitHub Advisory Database.
- Mavenorg.wso2.carbon.apimgt:org.wso2.carbon.apimgt.apiGHSA-cmjc-qp7j-xgwr (opens in a new tab)
- Mavenorg.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.publisher.v1GHSA-cmjc-qp7j-xgwr (opens in a new tab)
What to do
Solution: Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4104/#solution https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4104/#solution
References
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2025-30893 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisory GHSA-cmjc-qp7j-xgwr (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2025-4760)Record last updated .