An authenticated stored cross-site scripting (XSS) vulnerability exists in multiple WSO2 products due to improper validation of user-supplied input during API document upload in the Publisher portal. A user with publisher privileges can upload a crafted API document containing malicious JavaScript, which is later rendered in the browser when accessed by other users.

A successful attack could result in redirection to malicious websites, unauthorized UI modifications, or exfiltration of browser-accessible data. However, session-related sensitive cookies are protected by the httpOnly flag, preventing session hijacking.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.0005.

Exploitation none

Automatable no

Technical Impact partial

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
WSO2 WSO2 API Manager unaffected
Version Status Constraints
0 unknown < 3.2.0
3.2.0 affected < 3.2.0.428
3.2.1 affected < 3.2.1.48
4.1.0 affected < 4.1.0.209
4.2.0 affected < 4.2.0.145
4.3.0 affected < 4.3.0.60
4.4.0 affected < 4.4.0.23
4.5.0 affected < 4.5.0.7
WSO2 WSO2 API Control Plane unaffected
Version Status Constraints
4.5.0 affected < 4.5.0.8
WSO2 WSO2 Universal Gateway unaffected
Version Status Constraints
4.5.0 affected < 4.5.0.7
WSO2 WSO2 Traffic Manager unaffected
Version Status Constraints
4.5.0 affected < 4.5.0.7
WSO2 WSO2 Carbon API Management API unknown
Version Status Constraints
6.7.206 affected < 6.7.206.559
6.7.210 affected < 6.7.210.48
9.20.74 affected < 9.20.74.365
9.28.116 affected < 9.28.116.321
9.29.120 affected < 9.29.120.163
9.30.67 affected < 9.30.67.80
9.31.86 affected < 9.31.86.30
9.31.117 unaffected ≤ *

Configuration 1 [-]

OR cpe:2.3:a:wso2:api_control_plane:4.5.0:-:*:*:*:*:*:*
cpe:2.3:a:wso2:api_manager:3.2.0:*:*:*:*:*:*:*
cpe:2.3:a:wso2:api_manager:3.2.1:*:*:*:*:*:*:*
cpe:2.3:a:wso2:api_manager:4.1.0:-:*:*:*:*:*:*
cpe:2.3:a:wso2:api_manager:4.2.0:-:*:*:*:*:*:*
cpe:2.3:a:wso2:api_manager:4.3.0:-:*:*:*:*:*:*
cpe:2.3:a:wso2:api_manager:4.4.0:-:*:*:*:*:*:*
cpe:2.3:a:wso2:api_manager:4.5.0:-:*:*:*:*:*:*
cpe:2.3:a:wso2:traffic_manager:4.5.0:*:*:*:*:*:*:*
cpe:2.3:a:wso2:universal_gateway:4.5.0:*:*:*:*:*:*:*

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

Vendors Products
Wso2 Subscribe
Api Control Plane Subscribe
Api Manager Subscribe
Carbon Api Management Api Subscribe
Traffic Manager Subscribe
Universal Gateway Subscribe

Project Subscriptions

Vendors Products
Wso2 Subscribe
Api Control Plane Subscribe
Api Manager Subscribe
Carbon Api Management Api Subscribe
Traffic Manager Subscribe
Universal Gateway Subscribe
Advisories
Source ID Title
EUVD EUVD EUVD-2025-30893 WSO2 carbon-apimgt affected by an authenticated stored cross-site scripting (XSS) vulnerability
Github GHSA Github GHSA GHSA-cmjc-qp7j-xgwr WSO2 carbon-apimgt affected by an authenticated stored cross-site scripting (XSS) vulnerability
Fixes

Solution

Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4104/#solution https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4104/#solution

Workaround

No workaround given by the vendor.

References
Link Providers
https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4104/ cve-icon cve-icon
History

Fri, 21 Nov 2025 21:30:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:wso2:api_control_plane:4.5.0:-:*:*:*:*:*:*
cpe:2.3:a:wso2:api_manager:3.2.0:*:*:*:*:*:*:*
cpe:2.3:a:wso2:api_manager:3.2.1:*:*:*:*:*:*:*
cpe:2.3:a:wso2:api_manager:4.1.0:-:*:*:*:*:*:*
cpe:2.3:a:wso2:api_manager:4.2.0:-:*:*:*:*:*:*
cpe:2.3:a:wso2:api_manager:4.3.0:-:*:*:*:*:*:*
cpe:2.3:a:wso2:api_manager:4.4.0:-:*:*:*:*:*:*
cpe:2.3:a:wso2:api_manager:4.5.0:-:*:*:*:*:*:*
cpe:2.3:a:wso2:traffic_manager:4.5.0:*:*:*:*:*:*:*
cpe:2.3:a:wso2:universal_gateway:4.5.0:*:*:*:*:*:*:*

Thu, 25 Sep 2025 08:30:00 +0000

Type Values Removed Values Added
First Time appeared Wso2
Wso2 api Control Plane
Wso2 api Manager
Wso2 carbon Api Management Api
Wso2 traffic Manager
Wso2 universal Gateway
Vendors & Products Wso2
Wso2 api Control Plane
Wso2 api Manager
Wso2 carbon Api Management Api
Wso2 traffic Manager
Wso2 universal Gateway

Tue, 23 Sep 2025 20:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 23 Sep 2025 15:00:00 +0000

Type Values Removed Values Added
Description An authenticated stored cross-site scripting (XSS) vulnerability exists in multiple WSO2 products due to improper validation of user-supplied input during API document upload in the Publisher portal. A user with publisher privileges can upload a crafted API document containing malicious JavaScript, which is later rendered in the browser when accessed by other users. A successful attack could result in redirection to malicious websites, unauthorized UI modifications, or exfiltration of browser-accessible data. However, session-related sensitive cookies are protected by the httpOnly flag, preventing session hijacking.
Title Authenticated Stored Cross-Site Scripting (XSS) in Multiple WSO2 Products via API Document Upload in Publisher
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 4.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N'}

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: WSO2

Published:

Updated: 2025-09-23T19:58:26.062Z

Reserved: 2025-05-15T10:20:31.569Z

Link: CVE-2025-4760

cve-icon Vulnrichment

Updated: 2025-09-23T19:58:23.129Z

cve-icon NVD

Status : Analyzed

Published: 2025-09-23T15:15:31.063

Modified: 2025-11-21T21:29:56.007

Link: CVE-2025-4760

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2025-09-25T08:22:18Z

Weaknesses