CVE-2025-13672: Reflected Cross-Site Scripting discovered in OpenText WSM Management Server.

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-02-19 · updated 2026-06-17
Weakness: CWE-79

Description

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in OpenText™ Web Site Management Server allows Reflected XSS. The vulnerability could allow injecting malicious JavaScript inside URL parameters that was then rendered with the preview of the page, so that malicious scripts could be executed on the client side. This issue affects Web Site Management Server: 16.7.0, 16.7.1.

Affected products

OpenText™ Web Site Management Server: 16.7.0, 16.7.1

References

https://support.opentext.com/csm/en?id=ot_kb_unauthenticated&sysparm_article=KB0854847
https://github.com/MarioTesoro/vulnerability-research/blob/main/CVE-2025-13672/README.md

Get alerted when CVE-2025-13672 or the next vulnerability affects your stack