CVE-2025-12544

The Publisher portal in multiple WSO2 products is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient validation of uploaded SVG files . An attacker with the Publisher role can upload a crafted SVG file that, when rendered by the application, allows for the execution of malicious ...