CVE-2025-8591
Reflected Cross-Site Scripting via URL Parameter in Multiple WSO2 Products Enables UI Modification
- 6.1MediumCVSS base score
- 0.25%Exploitation in 30 daysEPSS · top 83% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
The software accepts user-supplied input via a URL parameter without adequate output encoding before reflecting it back to the user's browser. This condition allows an attacker to inject malicious script content into pages served by the application. By leveraging this weakness, an attacker can cause the user's browser to redirect to a malicious website, modify the UI of the webpage, or retrieve information from the browser. However, the impact is mitigated by the use of httpOnly flags on session-related cookies, preventing session hijacking.
Timeline
ID reserved
By WSO2
- 11 months later
· 11 months later
Published
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| WSO2CNA (assigner) | 3.1 | Medium6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
| NVDNVD · Analyzed | 3.1 | Medium6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
- EPSS (exploitation in 30 days)
- 0.25% · top 83% of all CVEs (12 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.1.
Affected products
- unknown < 5.10.0
- affected 5.10.0 – < 5.10.0.381
- affected 5.10.0 – < 5.10.0.384
- affected 6.0.0 – < 6.0.0.255
- affected 7.0.0 – < 7.0.0.131
- affected 7.1.0 – < 7.1.0.21
- affected 7.1.0 – < 7.1.0.51
- unknown < 3.1.0
- affected 3.1.0 – < 3.1.0.355
- affected 3.2.0 – < 3.2.0.459
- affected 3.2.1 – < 3.2.1.78
- affected 4.0.0 – < 4.0.0.380
- affected 4.1.0 – < 4.1.0.243
- affected 4.2.0 – < 4.2.0.183
- affected 4.3.0 – < 4.3.0.94
- affected 4.4.0 – < 4.4.0.58
- affected 4.5.0 – < 4.5.0.43
- affected 4.6.0 – < 4.6.0.7
- affected 4.5.0 – < 4.5.0.44
- affected 4.6.0 – < 4.6.0.8
- affected 4.5.0 – < 4.5.0.42
- affected 4.6.0 – < 4.6.0.7
- affected 4.5.0 – < 4.5.0.42
- affected 4.6.0 – < 4.6.0.7
- unknown < 2.0.0
- affected 2.0.0 – < 2.0.0.404
WSO2 · WSO2 Identity Server as Key Manager
- unknown < 5.10.0
- affected 5.10.0 – < 5.10.0.375
- unknown < 2.0.0
- affected 2.0.0 – < 2.0.0.424
What to do
Solution: Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4343/#solution
References
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2025-210428 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2025-8591)Record last updated .