---
id: CVE-2025-6623
title: >-
  Stored Cross-Site Scripting via XML Input in Multiple WSO2 Products Allows UI
  Manipulation and Redirection
summary: >-
  The carbon console accepts user-supplied XML input without sufficiently
  encoding potentially executable content, allowing for the injection of
  malicious scripts.


  Successful exploitation allows a remote attacker to execute arbitrary Java…
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:A/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-79
vendor: WSO2
product: WSO2 API Manager
affected:
  - api_manager >= 3.2.0 < 3.2.0.433
  - api_manager >= 3.2.1 < 3.2.1.53
  - api_manager >= 4.1.0 < 4.1.0.215
  - api_manager >= 4.2.0 < 4.2.0.153
  - api_manager >= 4.3.0 < 4.3.0.66
  - api_manager >= 4.4.0 < 4.4.0.29
  - api_manager >= 4.5.0 < 4.5.0.11
  - universal_gateway >= 4.5.0 < 4.5.0.11
  - traffic_manager >= 4.5.0 < 4.5.0.11
  - api_control_plane >= 4.5.0 < 4.5.0.12
  - >-
    org.wso2.carbon.analytics-common:org.wso2.carbon.event.publisher.ui >=
    5.2.26 < 5.2.26.19
  - >-
    org.wso2.carbon.analytics-common:org.wso2.carbon.event.publisher.ui >=
    5.2.41 < 5.2.41.6
  - >-
    org.wso2.carbon.analytics-common:org.wso2.carbon.event.publisher.ui >=
    5.2.57 < 5.2.57.7
  - >-
    org.wso2.carbon.analytics-common:org.wso2.carbon.event.publisher.ui >= 5.3.5
    < 5.3.5.4
  - >-
    org.wso2.carbon.analytics-common:org.wso2.carbon.event.publisher.ui >=
    5.3.11 < 5.3.11.4
  - >-
    org.wso2.carbon.analytics-common:org.wso2.carbon.event.publisher.ui >=
    5.3.15 < 5.3.15.3
  - >-
    org.wso2.carbon.analytics-common:org.wso2.carbon.event.publisher.ui >=
    5.3.20 < 5.3.20.1
  - >-
    org.wso2.carbon.analytics-common:org.wso2.carbon.event.receiver.ui >= 5.2.26
    < 5.2.26.19
  - >-
    org.wso2.carbon.analytics-common:org.wso2.carbon.event.receiver.ui >= 5.2.41
    < 5.2.41.6
  - >-
    org.wso2.carbon.analytics-common:org.wso2.carbon.event.receiver.ui >= 5.2.57
    < 5.2.57.7
  - >-
    org.wso2.carbon.analytics-common:org.wso2.carbon.event.receiver.ui >= 5.3.5
    < 5.3.5.4
  - >-
    org.wso2.carbon.analytics-common:org.wso2.carbon.event.receiver.ui >= 5.3.11
    < 5.3.11.4
  - >-
    org.wso2.carbon.analytics-common:org.wso2.carbon.event.receiver.ui >= 5.3.15
    < 5.3.15.3
  - >-
    org.wso2.carbon.analytics-common:org.wso2.carbon.event.receiver.ui >= 5.3.20
    < 5.3.20.1
published: '2026-10-19'
updated: '2026-10-19'
sourceUpdated: '2026-10-19T16:25:50.419Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2025-6623'
references:
  - url: >-
      https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4316/
  - url: 'https://github.com/wso2/carbon-analytics-common/pull/870'
tags:
  - cve.org
ingestedAt: '2026-10-19T17:33:42.478Z'
---

## Overview

The carbon console accepts user-supplied XML input without sufficiently encoding potentially executable content, allowing for the injection of malicious scripts.

Successful exploitation allows a remote attacker to execute arbitrary JavaScript in the context of a victim's browser, leading to actions such as redirecting the user to a malicious website or modifying the web page's user interface. Session hijacking is not possible as sensitive session cookies are protected by the httpOnly flag.

## Affected

- `api_manager >= 3.2.0 < 3.2.0.433`
- `api_manager >= 3.2.1 < 3.2.1.53`
- `api_manager >= 4.1.0 < 4.1.0.215`
- `api_manager >= 4.2.0 < 4.2.0.153`
- `api_manager >= 4.3.0 < 4.3.0.66`
- `api_manager >= 4.4.0 < 4.4.0.29`
- `api_manager >= 4.5.0 < 4.5.0.11`
- `universal_gateway >= 4.5.0 < 4.5.0.11`
- `traffic_manager >= 4.5.0 < 4.5.0.11`
- `api_control_plane >= 4.5.0 < 4.5.0.12`
- `org.wso2.carbon.analytics-common:org.wso2.carbon.event.publisher.ui >= 5.2.26 < 5.2.26.19`
- `org.wso2.carbon.analytics-common:org.wso2.carbon.event.publisher.ui >= 5.2.41 < 5.2.41.6`
- `org.wso2.carbon.analytics-common:org.wso2.carbon.event.publisher.ui >= 5.2.57 < 5.2.57.7`
- `org.wso2.carbon.analytics-common:org.wso2.carbon.event.publisher.ui >= 5.3.5 < 5.3.5.4`
- `org.wso2.carbon.analytics-common:org.wso2.carbon.event.publisher.ui >= 5.3.11 < 5.3.11.4`
- `org.wso2.carbon.analytics-common:org.wso2.carbon.event.publisher.ui >= 5.3.15 < 5.3.15.3`
- `org.wso2.carbon.analytics-common:org.wso2.carbon.event.publisher.ui >= 5.3.20 < 5.3.20.1`
- `org.wso2.carbon.analytics-common:org.wso2.carbon.event.receiver.ui >= 5.2.26 < 5.2.26.19`
- `org.wso2.carbon.analytics-common:org.wso2.carbon.event.receiver.ui >= 5.2.41 < 5.2.41.6`
- `org.wso2.carbon.analytics-common:org.wso2.carbon.event.receiver.ui >= 5.2.57 < 5.2.57.7`
- `org.wso2.carbon.analytics-common:org.wso2.carbon.event.receiver.ui >= 5.3.5 < 5.3.5.4`
- `org.wso2.carbon.analytics-common:org.wso2.carbon.event.receiver.ui >= 5.3.11 < 5.3.11.4`
- `org.wso2.carbon.analytics-common:org.wso2.carbon.event.receiver.ui >= 5.3.15 < 5.3.15.3`
- `org.wso2.carbon.analytics-common:org.wso2.carbon.event.receiver.ui >= 5.3.20 < 5.3.20.1`

## Remediation

Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4316/#solution