The vulnerability allows an attacker to inject arbitrary JavaScript through a URL parameter that is rendered in the browser without proper sanitization or encoding. This leads to reflected XSS, enabling the attacker to redirect the user to a malicious site, alter the page’s interface, or exfiltrate sensitive information from the browser. Session hijacking is limited because session cookies are marked httpOnly.

The affected products are WSO2 API Control Plane, WSO2 API Manager, and WSO2 Identity Server. Specific affected versions were not disclosed in the advisory.

The CVSS score of 6.1 indicates moderate severity, and the EPSS score of less than 1% suggests a low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is the creation of a crafted URL including a malicious script payload that triggers the reflected XSS in the victim’s browser.