Medium severity · published Feb 19, 2026
CVE-2025-13672
Reflected Cross-Site Scripting discovered in OpenText WSM Management Server.
5.4
CVSS
0.2%
EPSS
No
On KEV
Description
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in OpenText™ Web Site Management Server allows Reflected XSS. The vulnerability could allow injecting malicious JavaScript inside URL parameters that was then rendered with the preview of the page, so that malicious scripts could be executed on the client side.
This issue affects Web Site Management Server: 16.7.0, 16.7.1.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 14% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WS
Web Site Management Server · OpenText™
16.7.0; 16.7.1 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-13672
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-13672
Vendor Advisory
https://support.opentext.com/csm/en?id=ot_kb_unauthenticated&sysparm_article=KB0854847
Exploit
https://github.com/MarioTesoro/vulnerability-research/blob/main/CVE-2025-13672/README.md
More from Web Site Management Server
6.5
CVE-2025-13671
Cross Site request forgery vulnerability discovered in OpenText WSM Management Server.
5.4
CVE-2025-9208
Stored-XSS vulnerability discovered in OpenText WSM Management Server.