Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-4103— Cross-Site Scripting via HTML Sanitization in WSO2 Publisher and Developer Portals Allows Malicious Script Execution

Quick assessment

Affected
WSO2 WSO2 API Control Plane
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

WSO2 API Control Plane是美国WSO2公司的一款集中管理API生命周期与网络流量的服务器设备。 WSO2 API Control Plane 4.5.0版本至4.5.0.55之前版本和4.6.0版本至4.6.0.19之前版本，以及WSO2 API Manager 3.2.0版本至3.2.0.470之前版本、3.2.1版本至3.2.1.89之前版本、4.1.0版本至4.1.0.254之前版本、4.2.0版本至4.2.0.194之前版本、4.3.0版本至4.3.0.105之前版本、4.4.

CVSS 6.4 · Medium EPSS 0.30% · P23

Affected Version Matrix 11

VendorProduct Version RangeStatus
WSO2 WSO2 API Control Plane 4.5.0< 4.5.0.55 affected
4.6.0< 4.6.0.19 affected
WSO2 WSO2 API Manager < 3.2.0 unknown
3.2.0< 3.2.0.470 affected
3.2.1< 3.2.1.89 affected
4.1.0< 4.1.0.254 affected
4.2.0< 4.2.0.194 affected
4.3.0< 4.3.0.105 affected
4.4.0< 4.4.0.69 affected
4.5.0< 4.5.0.54 affected
… +1 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-4103

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Cross-Site Scripting via HTML Sanitization in WSO2 Publisher and Developer Portals Allows Malicious Script Execution
Source: CVE Program / CVE List V5
Vulnerability Description
Insufficient HTML sanitization in the Publisher Portal and Developer Portal allows untrusted user input to be rendered without proper encoding or neutralization. This enables the injection and execution of malicious JavaScript when affected API documents are viewed. Successful exploitation may result in the execution of malicious scripts within the user's browser context when viewing API documentation. Users with permissions to access the API documentation through these portals may be impacted, potentially allowing attackers to perform actions on behalf of the user, depending on their session privileges.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Vulnerability Title
WSO2 API Control Plane 跨站脚本漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
WSO2 API Control Plane是美国WSO2公司的一款集中管理API生命周期与网络流量的服务器设备。 WSO2 API Control Plane 4.5.0版本至4.5.0.55之前版本和4.6.0版本至4.6.0.19之前版本，以及WSO2 API Manager 3.2.0版本至3.2.0.470之前版本、3.2.1版本至3.2.1.89之前版本、4.1.0版本至4.1.0.254之前版本、4.2.0版本至4.2.0.194之前版本、4.3.0版本至4.3.0.105之前版本、4.4.
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
WSO2 WSO2 API Control Plane 4.5.0 ~ 4.5.0.55 -
WSO2 WSO2 API Manager 3.2.0 ~ 3.2.0.470 -

II. Public POCs for CVE-2026-4103

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-4103

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-4103 (1)

IV. Related Vulnerabilities

Same product: WSO2 API Control Plane
Same vendor: WSO2
Same weakness: CWE-79