CVE-2025-10853

moderate-risk

Published 2025-11-05

A reflected cross-site scripting (XSS) vulnerability exists in the management console of multiple WSO2 products due to improper output encoding. By tampering with specific parameters, a malicious actor can inject arbitrary JavaScript into the response, leading to reflected XSS. Successful exploitation could result in UI manipulation, redirection to malicious websites, or data theft from the browser. However, session-related sensitive cookies are protected with the httpOnly flag, which mitigates the risk of session hijacking.

Do I need to act?

0.02% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 5.2/10 Medium

ADJACENT_NETWORK / LOW complexity

Affected Products (20)

Api Control Plane

Api Manager

Enterprise Integrator

Identity Server

Identity Server As Key Manager

Open Banking Am

Open Banking Iam

Affected Vendors

Wso2

References (1)

Vendor Advisory https://security.docs.wso2.com/en/latest/security-announcements/security-advisor...

/ 100

moderate-risk

Severity 18/34 · Moderate

Exploitability 0/34 · Minimal

Exposure 20/34 · Moderate