---
id: CVE-2025-12544
title: Stored Cross-Site Scripting in Multiple WSO2 Products
summary: >-
  The Publisher portal fails to enforce proper validation on uploaded SVG files,
  allowing users with the Publisher role to inject malicious scripts. This
  weakness can be exploited by uploading a crafted SVG file, which is then
  stored and r…
severity: medium
cvss: 4.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-79
vendor: WSO2
product: WSO2 API Manager
affected:
  - api_manager >= 3.2.0 < 3.2.0.449
  - api_manager >= 3.2.1 < 3.2.1.68
  - api_manager >= 4.0.0 < 4.0.0.368
  - api_manager >= 4.1.0 < 4.1.0.60
  - api_manager >= 4.2.0 < 4.2.0.7
  - >-
    org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.publisher.v1 <
    9.28.140
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-02T17:00:46.138574Z'
published: '2026-11-02'
updated: '2026-11-02'
sourceUpdated: '2026-11-02T17:01:07.435Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2025-12544'
references:
  - url: >-
      https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4500/
tags:
  - cve.org
epss: 0.002
epssPercentile: 0.09913
ingestedAt: '2026-11-05T19:30:42.717Z'
---

## Overview

The Publisher portal fails to enforce proper validation on uploaded SVG files, allowing users with the Publisher role to inject malicious scripts. This weakness can be exploited by uploading a crafted SVG file, which is then stored and rendered by the application.

The security consequences include the ability for a malicious actor to redirect the victim's browser to an arbitrary website, modify the web page's UI, or retrieve information from the browser. However, the impact is mitigated as session-related sensitive cookies are protected with the httpOnly flag, preventing session hijacking.

## Affected

- `api_manager >= 3.2.0 < 3.2.0.449`
- `api_manager >= 3.2.1 < 3.2.1.68`
- `api_manager >= 4.0.0 < 4.0.0.368`
- `api_manager >= 4.1.0 < 4.1.0.60`
- `api_manager >= 4.2.0 < 4.2.0.7`
- `org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.publisher.v1 < 9.28.140`

## Remediation

Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4500/#solution