WSO2 Carbon: XSS via Unencoded XML Input in Carbon Console
CVE-2025-6623 Published on October 19, 2026

Stored Cross-Site Scripting via XML Input in Multiple WSO2 Products Allows UI Manipulation and Redirection
The carbon console accepts user-supplied XML input without sufficiently encoding potentially executable content, allowing for the injection of malicious scripts. Successful exploitation allows a remote attacker to execute arbitrary JavaScript in the context of a victim's browser, leading to actions such as redirecting the user to a malicious website or modifying the web page's user interface. Session hijacking is not possible as sensitive session cookies are protected by the httpOnly flag.

Vendor Advisory NVD

Vulnerability Analysis

Attack Vector:

ADJACENT_NETWORK

Attack Complexity:

LOW

Privileges Required:

HIGH

User Interaction:

REQUIRED

Scope:

CHANGED

Confidentiality Impact:

LOW

Integrity Impact:

LOW

Availability Impact:

NONE

Weakness Type

What is a XSS Vulnerability?

The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

CVE-2025-6623 has been classified to as a XSS vulnerability or weakness.

Products Associated with CVE-2025-6623

Want to know whenever a new CVE is published for Wso2 products? stack.watch will email you.

Wso2 Api Manager

Wso2 Universal Gateway

Wso2 Traffic Manager

Wso2 Api Control Plane

Wso2 Carbon Event Publisher Ui

Wso2 Carbon Event Receiver Ui

Affected Versions

WSO2 API Manager:

Before 3.2.0 is unknown.
Version 3.2.0 and below 3.2.0.433 is affected.
Version 3.2.1 and below 3.2.1.53 is affected.
Version 4.1.0 and below 4.1.0.215 is affected.
Version 4.2.0 and below 4.2.0.153 is affected.
Version 4.3.0 and below 4.3.0.66 is affected.
Version 4.4.0 and below 4.4.0.29 is affected.
Version 4.5.0 and below 4.5.0.11 is affected.

WSO2 Universal Gateway:

Before 4.5.0 is unknown.
Version 4.5.0 and below 4.5.0.11 is affected.

WSO2 Traffic Manager:

Before 4.5.0 is unknown.
Version 4.5.0 and below 4.5.0.11 is affected.

WSO2 API Control Plane:

Before 4.5.0 is unknown.
Version 4.5.0 and below 4.5.0.12 is affected.

WSO2 Carbon Event Publisher UI:

Version 5.2.26 and below 5.2.26.19 is affected.
Version 5.2.41 and below 5.2.41.6 is affected.
Version 5.2.57 and below 5.2.57.7 is affected.
Version 5.3.5 and below 5.3.5.4 is affected.
Version 5.3.11 and below 5.3.11.4 is affected.
Version 5.3.15 and below 5.3.15.3 is affected.
Version 5.3.20 and below 5.3.20.1 is affected.

WSO2 Carbon Event Receiver UI: