The user search function in the management console does not properly encode user‑supplied input before rendering it in the browser. This flaw allows attackers to inject and execute malicious scripts in the context of the console, enabling actions such as redirecting the user to a malicious site, modifying the page’s interface, or extracting data from the browser. The attack does not compromise session cookies because the httpOnly flag is set on sensitive cookies, limiting the ability to hijack sessions.

Products affected include WSO2 API Manager, WSO2 Carbon User Management UI, WSO2 Enterprise Integrator, and WSO2 Identity Server. No specific version information is provided in the advisory, so all supported versions may be vulnerable until patching instructions are applied.

The CVSS base score is 4.6, indicating moderate impact. EPSS is not available and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a reflected XSS that requires a user to be authenticated to the management console and to interact with the malicious payload, such as by clicking a crafted link or being lured to a malicious search query. Successful exploitation can compromise client‑side confidentiality and integrity but cannot directly hijack sessions or perform remote code execution on the server.