# CVE-2025-6623: WSO2 Carbon console stored cross-site scripting in XML input

Source: https://junglewise.ai/threats/cve-2025-6623-the-carbon-console-accepts-user-supplied-xml-input-without  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-19. Updated: 2026-10-19  
License: CC BY 4.0 with a link back

CVE-2025-6623 · Severity: medium · CVSS 4.3 · Published 2026-10-19

WSO2's Carbon console, used for managing API gateways and traffic control, accepts XML input without properly encoding potentially executable content. An authenticated attacker with administrative privileges can inject malicious scripts that execute in victims' browsers when they view affected pages, potentially redirecting users or altering the web interface. Session hijacking is prevented by httpOnly session cookies.

Technologies: [Wso2 API Control Plane](https://junglewise.ai/threats/technologies/api-control-plane), [Wso2 API Manager](https://junglewise.ai/threats/technologies/api-manager), [Wso2 Traffic Manager](https://junglewise.ai/threats/technologies/traffic-manager), [Wso2 Universal Gateway](https://junglewise.ai/threats/technologies/universal-gateway). Vendors: [Wso2](https://junglewise.ai/threats/vendors/wso2).

## Quick answers

**Is CVE-2025-6623 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-6623 being exploited in the wild.

**How severe is CVE-2025-6623?** Medium severity, with a CVSS score of 4.3, published 19 October 2026.

**Which products and versions are affected?** Wso2 API Control Plane 4.5.0; Wso2 API Manager 3.2.0, 3.2.1, 4.1.0, 4.2.0, 4.3.0, 4.4.0, 4.5.0; Wso2 Traffic Manager 4.5.0; Wso2 Universal Gateway 4.5.0.

**Is there a fix for CVE-2025-6623?** Yes: fixed in WSO2 API Control Plane 4.5.0 Update 12; WSO2 API Manager 4.5.0 Update 11, 4.4.0 Update 29, 4.3.0 Update 66, 4.2.0 Update 153, 4.1.0 Update 215, 3.2.1 Update 53, 3.2.0 Update 433; WSO2 Traffic Manager 4.5.0 Update 11; WSO2 Universal Gateway 4.5.0 Update 11. Until then: Apply the fix from https://github.com/wso2/carbon-analytics-common/pull/870 or upgrade to the relevant update level for your product. Restrict administrative console access to trusted users only. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-6623 attacked?** It is attacked from the adjacent network, in a web application.

**Am I affected by CVE-2025-6623?** Check whether you run Wso2 API Control Plane, Wso2 API Manager, Wso2 Traffic Manager or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in WSO2 API Control Plane 4.5.0 Update 12; WSO2 API Manager 4.5.0 Update 11, 4.4.0 Update 29, 4.3.0 Update 66, 4.2.0 Update 153, 4.1.0 Update 215, 3.2.1 Update 53, 3.2.0 Update 433; WSO2 Traffic Manager 4.5.0 Update 11; WSO2 Universal Gateway 4.5.0 Update 11

Apply the fix from https://github.com/wso2/carbon-analytics-common/pull/870 or upgrade to the relevant update level for your product. Restrict administrative console access to trusted users only.

## Technical details

Stored XSS vulnerability in Carbon console due to improper output encoding of user-supplied XML input. An authenticated administrative user can inject malicious JavaScript payloads through XML fields; when other users view the affected page, the payload executes in their browser context. The vulnerability requires administrative privileges and user interaction, but enables persistent injection attacks across multiple visitors.

## Affected products

- WSO2 API Control Plane 4.5.0
- WSO2 API Manager 3.2.0, 3.2.1, 4.1.0, 4.2.0, 4.3.0, 4.4.0, 4.5.0
- WSO2 Traffic Manager 4.5.0
- WSO2 Universal Gateway 4.5.0

## Timeline

- 2026-01-26: disclosed: WSO2 security advisory published

## References

- [https://github.com/wso2/carbon-analytics-common/pull/870](https://github.com/wso2/carbon-analytics-common/pull/870)
- [https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4316/](https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4316/)

## Related threats

- [WSO2 Identity Server privilege escalation via shared database](https://junglewise.ai/threats/cve-2026-4052-this-issue-only-impacts-deployments-where-wso2-identity-server-is)
- [WSO2 API Manager Admin REST API SQL injection](https://junglewise.ai/threats/cve-2026-2613-the-admin-rest-api-accepts-user-supplied-input-without-adequately)
- [WSO2 API Manager SVG upload stored XSS in Publisher portal](https://junglewise.ai/threats/cve-2025-12544-the-publisher-portal-fails-to-enforce-proper-validation-on)
- [WSO2 products sensitive information disclosure in Event Publisher logs](https://junglewise.ai/threats/cve-2026-18800-when-an-event-publisher-output-adapter-is-configured-with)
- [WSO2 System REST APIs access control bypass](https://junglewise.ai/threats/cve-2025-11969-the-system-rest-apis-do-not-correctly-enforce-access-control)