A stored cross-site scripting (XSS) vulnerability exists in the Management Console of multiple WSO2 products due to insufficient input validation Rich Text Editor within registry section. To exploit this vulnerability, a malicious actor must have valid user account with administrative access Console. If successful, could inject persistent JavaScript payloads, enabling theft data or execution unauthorized actions on behalf other users. While issue enables client-side script execution, session-related cookies remain protected httpOnly flag, preventing session hijacking.