Reflected Cross-Site Scripting (XSS) in Management Console of Multiple WSO2 Products Due to Improper Output Encoding

published 2025-11-05 12 mo ago modified 2026-06-17 4 mo ago also EUVD-2025-37927

cvss: 5.2; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.2%; EPSS 0.2% chance of exploitation in 30 days, percentile 9%
public exploits: 0; none known

A reflected cross-site scripting (XSS) vulnerability exists in the management console of multiple WSO2 products due to improper output encoding. By tampering with specific parameters, a malicious actor can inject arbitrary JavaScript into the response, leading to reflected XSS.

Successful exploitation could result in UI manipulation, redirection to malicious websites, or data theft from the browser. However, session-related sensitive cookies are protected with the httpOnly flag, which mitigates the risk of session hijacking.

Patch / fix

fixed in 13

WSO2 WSO2 Open Banking IAM 2.0.0.413
WSO2 WSO2 API Manager 3.1.0.344, 3.2.0.445, 3.2.1.65, 4.0.0.365, 4.1.0.227, 4.2.0.167, 4.3.0.79, 4.4.0.43, 4.5.0.26
WSO2 WSO2 Identity Server 5.10.0.373, 5.11.0.417, 6.0.0.247, 6.1.0.246, 7.0.0.122, 7.1.0.29
WSO2 WSO2 Open Banking AM 2.0.0.393
WSO2 WSO2 Identity Server as Key Manager 5.10.0.363
WSO2 WSO2 Enterprise Integrator 6.6.0.223
WSO2 WSO2 API Control Plane 4.5.0.27
WSO2 WSO2 Universal Gateway 4.5.0.25
WSO2 WSO2 Traffic Manager 4.5.0.25
WSO2 org.wso2.carbon.registry:org.wso2.carbon.registry.info.ui 4.7.32.14, 4.7.35.11, 4.7.39.9, 4.7.51.4, 4.8.3.9, 4.8.13.6, 4.8.32.3, 4.8.36.1, 4.8.43.1, 4.8.47
WSO2 org.wso2.carbon.registry:org.wso2.carbon.registry.resource.ui 4.7.24.7, 4.7.32.14, 4.7.33.13, 4.7.35.11, 4.7.39.9, 4.7.51.4, 4.8.3.9, 4.8.9.5, 4.8.12.5, 4.8.13.6, 4.8.24.3, 4.8.32.3, 4.8.36.1, 4.8.43.1, 4.8.47
WSO2 org.wso2.carbon.governance:org.wso2.carbon.governance.wsdltool.ui 4.8.19.5, 4.8.21.9, 4.8.28.3, 4.8.30.3, 4.8.32.1, 4.8.33.3, 4.8.34.3
WSO2 org.wso2.carbon.identity.inbound.auth.oauth2:org.wso2.carbon.identity.oauth.ui 6.4.2.165, 6.4.111.155, 6.4.176.28, 6.4.180.12, 6.9.6.26, 6.13.16.19, 6.13.19.12, 6.13.27.5, 6.13.38, 7.0.349

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 12 mo ago (2025-11-05)

Exploit prediction

0.19% chance of exploitation in the next 30 days, higher than 9% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	5.2	CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
NVD	3.1	6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected products

WSO2 WSO2 Open Banking IAM
WSO2 WSO2 API Manager
WSO2 WSO2 Identity Server
WSO2 WSO2 Open Banking AM
WSO2 WSO2 Identity Server as Key Manager
WSO2 WSO2 Enterprise Integrator
WSO2 WSO2 API Control Plane
WSO2 WSO2 Universal Gateway
WSO2 WSO2 Traffic Manager
WSO2 org.wso2.carbon.registry:org.wso2.carbon.registry.info.ui
WSO2 org.wso2.carbon.registry:org.wso2.carbon.registry.resource.ui
WSO2 org.wso2.carbon.governance:org.wso2.carbon.governance.wsdltool.ui
WSO2 org.wso2.carbon.identity.inbound.auth.oauth2:org.wso2.carbon.identity.oauth.ui

Classification

Weakness

CWE-79 Improper Neutralization of Input During Web Page Generation

References

security.docs.wso2.com /en/latest/security-announcements/security-advisories/2025/WSO2-2025-4486/
vendor-advisory

Sources

CVE List CVE-2025-10853
NVD CVE-2025-10853

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary