All vulnerabilities
CVE-2025-6623

Stored Cross-Site Scripting via XML Input in Multiple WSO2 Products Allows UI Manipulation and Redirection

WSO2 WSO2 API Manager
Open in ThreatlineRecord JSON
CVSS
4.3Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.22%Chance of exploitation activity in the next 30 days, higher than 12% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in3.2.0.433Also 3.2.1.53, 4.1.0.215 and 12 moreCVE List
Published19 Oct 2026Updated 20 Oct 2026CVE List

What fixes it

Show all 24 fixed versions
  • 4.5.0.11WSO2 API ManagerCVE List
  • 4.5.0.11WSO2 Universal GatewayCVE List
  • 4.5.0.11WSO2 Traffic ManagerCVE List
  • 4.5.0.12WSO2 API Control PlaneCVE List
  • 5.2.26.19WSO2 Carbon Event Publisher UICVE List
  • 5.2.41.6WSO2 Carbon Event Publisher UICVE List
  • 5.2.57.7WSO2 Carbon Event Publisher UICVE List
  • 5.3.5.4WSO2 Carbon Event Publisher UICVE List
  • 5.3.11.4WSO2 Carbon Event Publisher UICVE List
  • 5.3.15.3WSO2 Carbon Event Publisher UICVE List
  • 5.3.20.1WSO2 Carbon Event Publisher UICVE List
  • 5.2.26.19WSO2 Carbon Event Receiver UICVE List
  • 5.2.41.6WSO2 Carbon Event Receiver UICVE List
  • 5.2.57.7WSO2 Carbon Event Receiver UICVE List
  • 5.3.5.4WSO2 Carbon Event Receiver UICVE List
  • 5.3.11.4WSO2 Carbon Event Receiver UICVE List
  • 5.3.15.3WSO2 Carbon Event Receiver UICVE List
  • 5.3.20.1WSO2 Carbon Event Receiver UICVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

The carbon console accepts user-supplied XML input without sufficiently encoding potentially executable content, allowing for the injection of malicious scripts.

Successful exploitation allows a remote attacker to execute arbitrary JavaScript in the context of a victim's browser, leading to actions such as redirecting the user to a malicious website or modifying the web page's user interface. Session hijacking is not possible as sensitive session cookies are protected by the httpOnly flag.

Text from CVE List

Affected versions 28

  • WSO2 API Managerunknown: all versions before 3.2.0CVE List
  • WSO2 API Manageraffected: 3.2.0 before 3.2.0.433CVE List
  • WSO2 API Manageraffected: 3.2.1 before 3.2.1.53CVE List
  • WSO2 API Manageraffected: 4.1.0 before 4.1.0.215CVE List
  • WSO2 API Manageraffected: 4.2.0 before 4.2.0.153CVE List
  • WSO2 API Manageraffected: 4.3.0 before 4.3.0.66CVE List
  • WSO2 API Manageraffected: 4.4.0 before 4.4.0.29CVE List
  • WSO2 API Manageraffected: 4.5.0 before 4.5.0.11CVE List
  • WSO2 Universal Gatewayunknown: all versions before 4.5.0CVE List
  • WSO2 Universal Gatewayaffected: 4.5.0 before 4.5.0.11CVE List
  • WSO2 Traffic Managerunknown: all versions before 4.5.0CVE List
  • WSO2 Traffic Manageraffected: 4.5.0 before 4.5.0.11CVE List
  • WSO2 API Control Planeunknown: all versions before 4.5.0CVE List
  • WSO2 API Control Planeaffected: 4.5.0 before 4.5.0.12CVE List
  • WSO2 Carbon Event Publisher UIaffected: 5.2.26 before 5.2.26.19CVE List
  • WSO2 Carbon Event Publisher UIaffected: 5.2.41 before 5.2.41.6CVE List
  • WSO2 Carbon Event Publisher UIaffected: 5.2.57 before 5.2.57.7CVE List
  • WSO2 Carbon Event Publisher UIaffected: 5.3.5 before 5.3.5.4CVE List
  • WSO2 Carbon Event Publisher UIaffected: 5.3.11 before 5.3.11.4CVE List
  • WSO2 Carbon Event Publisher UIaffected: 5.3.15 before 5.3.15.3CVE List
  • WSO2 Carbon Event Publisher UIaffected: 5.3.20 before 5.3.20.1CVE List
  • WSO2 Carbon Event Receiver UIaffected: 5.2.26 before 5.2.26.19CVE List
  • WSO2 Carbon Event Receiver UIaffected: 5.2.41 before 5.2.41.6CVE List
  • WSO2 Carbon Event Receiver UIaffected: 5.2.57 before 5.2.57.7CVE List
  • WSO2 Carbon Event Receiver UIaffected: 5.3.5 before 5.3.5.4CVE List
  • WSO2 Carbon Event Receiver UIaffected: 5.3.11 before 5.3.11.4CVE List
  • WSO2 Carbon Event Receiver UIaffected: 5.3.15 before 5.3.15.3CVE List
  • WSO2 Carbon Event Receiver UIaffected: 5.3.20 before 5.3.20.1CVE List

References 2