# CVE-2025-12544: Stored Cross-Site Scripting in Multiple WSO2 Products

Status: published. Published: 2026-11-02. Updated: 2026-11-02.

The Publisher portal fails to enforce proper validation on uploaded SVG files, allowing users with the Publisher role to inject malicious scripts. This weakness can be exploited by uploading a crafted SVG file, which is then stored and rendered by the application.

The security consequences include the ability for a malicious actor to redirect the victim's browser to an arbitrary website, modify the web page's UI, or retrieve information from the browser. However, the impact is mitigated as session-related sensitive cookies are protected with the httpOnly flag, preventing session hijacking.

## Remediation

- fix: Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4500/#solution (source: CNA: WSO2)

## Affected products and versions

- WSO2 / WSO2 API Manager: ≥ 0; < 3.2.0 (unknown, custom); ≥ 3.2.0; < 3.2.0.449 (affected, custom); ≥ 3.2.1; < 3.2.1.68 (affected, custom); ≥ 4.0.0; < 4.0.0.368 (affected, custom); ≥ 4.1.0; < 4.1.0.60 (affected, custom); ≥ 4.2.0; < 4.2.0.7 (affected, custom). Source: CNA: WSO2
- WSO2 / WSO2 Carbon API Manager Publisher REST API (org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.publisher.v1): ≥ 0; < 9.28.140 (affected, custom). Source: CNA: WSO2

## Severity and prioritization

- CVSS 3.1: 4.8 (medium); CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N; source: CNA: WSO2

- CVSS 3.1: 4.8 (medium); CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N; source: NVD: ed10eef1-636d-4fbe-9993-6890dfa878f8

- CISA KEV: No listing in collected sources

- EPSS: Not available

- SSVC: Not available

- Weaknesses: CWE-79

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4500/ (CNA: WSO2; vendor-advisory)

- https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4500/ (ed10eef1-636d-4fbe-9993-6890dfa878f8)

## Provenance

- CNA: WSO2: https://www.cve.org/CVERecord?id=CVE-2025-12544; retrieved 2026-11-02; source updated 2026-11-02

- NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-12544; retrieved 2026-11-02; source updated 2026-11-02

Revision: 6f90095607e052e3d1e59ec5109b40767a22cc37efffcc3a0d8cf057184204a4

Canonical: https://y2.dev/cve/CVE-2025-12544