What’s Vulnerable › Products

WSO2 API Control Plane vulnerabilities

10 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 8 published in the last 12 months.

Check whether your WSO2 API Control Plane version is affected

Latest WSO2 API Control Plane vulnerabilities

• CVE-2025-7203 — Sensitive Information Disclosure via Management Console and Product Files in Multiple WSO2 Products Allows Retrieval of Credentials (CVSS 4.9)
• CVE-2025-6623 — Stored Cross-Site Scripting via XML Input in Multiple WSO2 Products Allows UI Manipulation and Redirection (CVSS 4.3)
• CVE-2025-13173 — Improper Token Revocation via Session-Bound Token Flow in Multiple WSO2 Products Allows Unauthorized Access After Session Termination (CVSS 6.5)
• CVE-2025-5802 — Username Enumeration via Self Registration Flow in Multiple WSO2 Products Allows User Account Discovery (CVSS 5.3)
• CVE-2026-4103 — Cross-Site Scripting via HTML Sanitization in WSO2 Publisher and Developer Portals Allows Malicious Script Execution (CVSS 6.4)
• CVE-2026-3096 — Reverse Tabnabbing via New Tab Navigation in Multiple WSO2 Products Allows Phishing and Credential Theft (CVSS 4.7)
• CVE-2026-3418 — Arbitrary File Upload via System REST API in Multiple WSO2 Products Allows Remote Code Execution (CVSS 9.1)
• CVE-2025-14561 — Access Control Bypass via Publisher REST APIs in Multiple WSO2 Products Allows Cross-Tenant Operations (CVSS 9.0)