CVE-2025-4760
Authenticated Stored Cross-Site Scripting (XSS) in Multiple WSO2 Products via API Document Upload in Publisher
An authenticated stored cross-site scripting (XSS) vulnerability exists in multiple WSO2 products due to improper validation of user-supplied input during API document upload in the Publisher portal. A user with publisher privileges can upload a crafted API document containing malicious JavaScript, which is later rendered in the browser when accessed by other users.
A successful attack could result in redirection to malicious websites, unauthorized UI modifications, or exfiltration of browser-accessible data. However, session-related sensitive cookies are protected by the httpOnly flag, preventing session hijacking.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- High
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Authenticated Stored Cross-Site Scripting (XSS) in Multiple WSO2 Products via API Document Upload in Publisher
An authenticated stored cross-site scripting (XSS) vulnerability exists in multiple WSO2 products due to improper validation of user-supplied input during API document upload in the Publisher portal. A user with publisher privileges can upload a crafted API document containing malicious JavaScript, which is later rendered in the browser when accessed by other users.
A successful attack could result in redirection to malicious websites, unauthorized UI modifications, or exfiltration of browser-accessible data. However, session-related sensitive cookies are protected by the httpOnly flag, preventing session hijacking.
- Record
CVE-2025-4760- CVSS 3.1
- 4.8 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
EUVDEUVD-2025-30893
An authenticated stored cross-site scripting (XSS) vulnerability exists in multiple WSO2 products due to improper validation of user-supplied input during API document upload in the Publisher portal. A user with publisher privileges can upload a crafted API document containing malicious JavaScript, which is later rendered in the browser when accessed by other users.
A successful attack could result in redirection to malicious websites, unauthorized UI modifications, or exfiltration of browser-accessible data. However, session-related sensitive cookies are protected by the httpOnly flag, preventing session hijacking.
- Record
EUVD-2025-30893- CVSS 3.1
- 4.8 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-cmjc-qp7j-xgwr
WSO2 carbon-apimgt affected by an authenticated stored cross-site scripting (XSS) vulnerability
An authenticated stored Cross-Site Scripting (XSS) vulnerability exists in WSO2 API Manager components (carbon-apimgt) due to insufficient validation of user-supplied input during API document upload in the Publisher portal.
A user with publisher privileges can upload a crafted API document whose contents are later rendered in the UI for other users, leading to attacker-controlled script execution. Likely outcomes include redirection to malicious sites, unauthorized UI modifications, or exfiltration of data accessible to the browser; session hijacking is mitigated by the use of HttpOnly session cookies.
To remediate, update to version 9.31.117 or above.
- Record
GHSA-cmjc-qp7j-xgwr- CVSS 3.1
- 4.8 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
NVD
An authenticated stored cross-site scripting (XSS) vulnerability exists in multiple WSO2 products due to improper validation of user-supplied input during API document upload in the Publisher portal. A user with publisher privileges can upload a crafted API document containing malicious JavaScript, which is later rendered in the browser when accessed by other users.
A successful attack could result in redirection to malicious websites, unauthorized UI modifications, or exfiltration of browser-accessible data. However, session-related sensitive cookies are protected by the httpOnly flag, preventing session hijacking.
- Record
CVE-2025-4760- CVSS 3.1
- 4.8 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV
An authenticated stored cross-site scripting (XSS) vulnerability exists in multiple WSO2 products due to improper validation of user-supplied input during API document upload in the Publisher portal. A user with publisher privileges can upload a crafted API document containing malicious JavaScript, which is later rendered in the browser when accessed by other users.
A successful attack could result in redirection to malicious websites, unauthorized UI modifications, or exfiltration of browser-accessible data. However, session-related sensitive cookies are protected by the httpOnly flag, preventing session hijacking.
- Record
CVE-2025-4760- CVSS 3.1
- 4.8 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-03
OSVGHSA-cmjc-qp7j-xgwr
WSO2 carbon-apimgt affected by an authenticated stored cross-site scripting (XSS) vulnerability
An authenticated stored Cross-Site Scripting (XSS) vulnerability exists in WSO2 API Manager components (carbon-apimgt) due to insufficient validation of user-supplied input during API document upload in the Publisher portal.
A user with publisher privileges can upload a crafted API document whose contents are later rendered in the UI for other users, leading to attacker-controlled script execution. Likely outcomes include redirection to malicious sites, unauthorized UI modifications, or exfiltration of data accessible to the browser; session hijacking is mitigated by the use of HttpOnly session cookies.
To remediate, update to version 9.31.117 or above.
- Record
GHSA-cmjc-qp7j-xgwr- CVSS 3.1
- 4.8 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.apiMaven |
before 9.31.117 | 9.31.117 |
org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.publisher.v1Maven |
before 9.31.117 | 9.31.117 |
org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.apiMaven |
before 9.31.117, plus listed versions 1.3.01.3.11.3.21.3.31.4.0 Show 45 moreShow less2.0.02.0.14.3.04.3.15.0.05.0.15.0.25.0.35.0.45.0.56.0.06.0.16.0.26.0.36.0.46.0.56.1.0-alpha6.1.1-beta6.1.106.1.1006.1.1016.1.1026.1.1036.1.1046.1.1056.1.1066.1.1076.1.1086.1.1096.1.116.1.1106.1.1116.1.1126.1.1136.1.1146.1.1156.1.1166.1.1176.1.1186.1.1196.1.126.1.1206.1.1216.1.1226.1.123 |
9.31.117 |
org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.publisher.v1Maven |
before 9.31.117, plus listed versions 6.4.1946.4.1956.4.1966.4.1976.4.198 Show 45 moreShow less6.4.1996.4.2006.4.2016.4.2026.4.2036.4.2046.4.2056.4.2066.4.2076.4.2086.4.2096.4.2106.4.2116.5.1216.5.1226.5.1236.5.1246.5.1256.5.1266.5.1276.5.1286.5.1296.5.1306.5.1316.5.1326.5.1336.5.1356.5.1366.5.1376.5.1386.5.1406.5.1416.5.1426.5.1436.5.1446.5.1456.5.1466.5.1476.5.1486.5.1496.5.1506.5.1516.5.1526.5.1536.5.154 |
9.31.117 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-4760 is a medium vulnerability (CVSS 4.8) in Wso2 Api Control Plane, published September 23, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.19%, the 8th percentile. Fixed in org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.api 9.31.117.
References
security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4104
nvd.nist.gov/vuln/detail/CVE-2025-4760
github.com/wso2/carbon-apimgt/pull/13099
mvnrepository.com/artifact/org.wso2.carbon.apimgt/org.wso2.carbon.apimgt.api/9.31.117
Left out here: 4,659 versions. The JSON record has them.