The flaw is caused by the application accepting user‑supplied data through a URL parameter and reflecting it back to the browser without applying sufficient output encoding. This defect allows an attacker to inject malicious script that executes in the victim’s browser, enabling actions such as redirecting the user to a malicious site, altering the page’s user interface, or reading and transmitting data from the browser. The use of httpOnly limits the risk of session hijacking, so the primary impact resides in client‑side manipulation and potential data leakage rather than server‑side compromise.

All variants of WSO2 API Control Plane, WSO2 API Manager, WSO2 Identity Server (including Key Manager), WSO2 Open Banking AM, WSO2 Open Banking IAM, WSO2 Traffic Manager, and WSO2 Universal Gateway are affected. No specific version range is listed, so any released version of these products prior to the advisory’s fix is considered vulnerable.

The CVSS score of 6.1 indicates a moderate severity. The EPSS score of < 1% reflects a very low probability that the vulnerability will be actively exploited in the wild. The fact that it is not listed in CISA’s KEV catalog also suggests limited exploitation activity. Based on the description, it is inferred that the attacker would need to persuade a victim to interact with a crafted URL. This client‑side attack could lead to malicious redirection, UI modification, or data exfiltration but does not provide remote code execution on the server.