The vulnerability stems from the WSO2 API Manager developer portal’s failure to enforce proper validation and output encoding on user‑supplied input. Injected script content executes within the victim’s browser context, enabling attackers to redirect the browser, modify the portal’s user interface, or extract data visible to the browser. Cookie protection via the httpOnly flag prevents direct session hijacking, so the attacker’s impact is limited to what can be accessed or manipulated through client‑side scripting.

WSO2 API Manager is the affected vendor and product. No specific version information is available in the advisory, so all releases of the API Manager product should be considered at risk until a patch is applied.

The CVSS score of 5.4 indicates a medium severity. EPSS information is not available, and the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit this via any public interface that accepts user input on the developer portal, such as input fields, comments, or custom content. Because session cookies are httpOnly, an attacker cannot hijack sessions, but they can still perform actions confined to the victim’s browser context and access data exposed within that context.