Three distinct reflected cross-site scripting vulnerabilities exist in the management console of multiple WSO2 products, grouped under a single CVE. In each case, user-controlled input is reflected into the HTML response without sanitisation. The affected endpoints are:
subscription-email-verification.jspmex_add_ajaxprocessor.jspxml_resource_visualizer_ajaxprocessor.jspIf a server administrator follows a malicious link, the injected JavaScript executes in the context of the management console session. From there, the attacker can invoke SOAP admin services (CVE-2025-10907) to achieve one-click remote code execution on the underlying server.
This vulnerability was responsibly disclosed and has been patched by the vendor.