The vulnerability resides in the carbon console’s handling of user‑supplied XML input. Because the console does not properly encode content that may be interpreted as executable, malicious scripts can be stored and later served to users. Once delivered, these scripts run with the privileges of the requesting browser, allowing an attacker to redirect the user or alter the page’s interface, though session cookies remain protected by the httpOnly flag.

The affected products are WSO2 API Control Plane, WSO2 API Manager, WSO2 Carbon Event Publisher UI, WSO2 Carbon Event Receiver UI, WSO2 Traffic Manager, and WSO2 Universal Gateway. No specific versions are listed, so all current releases should be evaluated for the presence of this flaw.

The CVSS score of 4.3 classifies this flaw as low severity, but because the payload is execution of JavaScript in the user’s context, an attacker can perform phishing, UI defacement, or other malicious redirections. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited known exploitation. The attack vector is remote: an attacker can supply malicious XML through the console’s input fields; the payload is stored and later rendered when the interface is accessed by any user. Satellite exploitation does not appear necessary, and session hijacking is not possible due to httpOnly cookie protection.