CVE-2026-18059: Exposure of Sensitive Information to an Unauthorized Actor

The PixelYourSite – Your smart PIXEL TAG & API Manager plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 11.2.1 via the getWooPurchaseEventParams. This makes it possible for unauthenticated attackers to extract WooCommerce purchase metadata...

CVE-2026-2053

The WSO2 API Manager's message flow component, when processing WS-Addressing headers, does not sufficiently validate or restrict user-controlled input within these headers. This omission allows an attacker to manipulate WS-Addressing headers to specify arbitrary destinations for server-initiated...

CVE-2026-2053

The CVE-2026-2053 entry concerns the WSO2 API Manager: the message flow component mishandles WS-Addressing headers by not adequately validating user-controlled input, allowing an attacker to manipulate headers to set arbitrary destinations for server-initiated requests. This results in unauthenti...

CVE-2026-2053

The WSO2 API Manager's message flow component, when processing WS-Addressing headers, does not sufficiently validate or restrict user-controlled input within these headers. This omission allows an attacker to manipulate WS-Addressing headers to specify arbitrary destinations for server-initiated...

CVE-2026-2053 Unauthenticated Server-Side Request Forgery via WS-Addressing in WSO2 API Manager

The WSO2 API Manager's message flow component, when processing WS-Addressing headers, does not sufficiently validate or restrict user-controlled input within these headers. This omission allows an attacker to manipulate WS-Addressing headers to specify arbitrary destinations for server-initiated...

CVE-2026-2053: Server-Side Request Forgery (SSRF)

The WSO2 API Manager's message flow component, when processing WS-Addressing headers, does not sufficiently validate or restrict user-controlled input within these headers. This omission allows an attacker to manipulate WS-Addressing headers to specify arbitrary destinations for server-initiated...

CVE-2025-8325

Technical details are not publicly available in the provided documents. Monitor for updates on CVE-2025-8325; current sources describe an RBAC bypass affecting Gateway and Internal Service APIs in WSO2 products, but no concrete technical specifics are provided here.

org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.service.catalog.feature (>=8.2.11, <=9.33.97) potentially affected by CVE-2025-8325 via org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.util (>=8.2.11, <=9.33.97)

org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.util MAVEN version =8.2.11, =8.2.11, =9.33.97 Source cves: CVE-2025-8325 Source advisory: MEND:CVE-2025-8325...

PT-2026-53824

Name of the Vulnerable Software and Affected Versions WSO2 API Manager versions 4.1.0 through 4.6.0 WSO2 API Control Plane versions 4.5.0 through 4.6.0 WSO2 Traffic Manager versions 4.5.0 through 4.6.0 WSO2 Universal Gateway versions 4.5.0 through 4.6.0 Description The JWT authentication mechanis...

anadroid (>=0.5.56, <=0.5.59), anomalib (>=0.2.2, <=0.2.4) +88 more potentially affected by CVE-2026-41066 via lxml (4.6.5)

lxml PYPI version 4.6.5 is affected by a known vulnerability. The following packages have a transitive dependency on lxml and may be impacted: - anadroid =0.5.56, =0.2.2, =0.1.1, =1.1.20, =0.2.0, =5.0.0, =9.1.2, =0.0.1, =0.0.1, =3.0.0, =0.0.0a1, =1.0.0, =0.6.13, =0.0.1, =0.0.26 and more Source...

EUVD-2024-55547

The WSO2 API Manager developer portal accepts user-supplied input without enforcing expected validation constraints or proper output encoding. This deficiency allows a malicious actor to inject script content that is executed within the context of a user's browser. By leveraging this cross-site...

CVE-2024-4867

The WSO2 API Manager developer portal accepts user-supplied input without enforcing expected validation constraints or proper output encoding. This deficiency allows a malicious actor to inject script content that is executed within the context of a user's browser. By leveraging this cross-site...

CVE-2024-10242

The CVE-2024-10242 entry describes a reflected cross-site scripting vulnerability in the authentication endpoint of WSO2 API Manager. The flaw stems from inadequate validation of user-supplied input that is reflected in the response, enabling an attacker to inject script payloads that execute in ...

CVE-2024-8010 XML External Entity Injection via Publisher in WSO2 API Manager Allows Reading Arbitrary Files

The component accepts XML input through the publisher without disabling external entity resolution. This allows malicious actors to submit a crafted XML payload that exploits the unescaped external entity references. By leveraging this vulnerability, a malicious actor can read confidential files...

CVE-2024-4867 Cross-Site Scripting via Developer Portal in WSO2 API Manager Enables UI Modification and Information Retrieval

The WSO2 API Manager developer portal accepts user-supplied input without enforcing expected validation constraints or proper output encoding. This deficiency allows a malicious actor to inject script content that is executed within the context of a user's browser. By leveraging this cross-site...

CVE-2024-4867 Cross-Site Scripting via Developer Portal in WSO2 API Manager Enables UI Modification and Information Retrieval

The WSO2 API Manager developer portal accepts user-supplied input without enforcing expected validation constraints or proper output encoding. This deficiency allows a malicious actor to inject script content that is executed within the context of a user's browser. By leveraging this cross-site...

CVE-2024-4867

The CVE-2024-4867 entry describes a cross-site scripting (XSS) vulnerability in the WSO2 API Manager developer portal. User-supplied input is not properly validated or output-encoded, enabling injection of script content executed in the user’s browser. Exploitation can cause the UI to redirect to...

PT-2026-33303

The WSO2 API Manager developer portal accepts user-supplied input without enforcing expected validation constraints or proper output encoding. This deficiency allows a malicious actor to inject script content that is executed within the context of a user's browser. By leveraging this cross-site...

CVE-2024-4867: Improper Neutralization of Input During Web Page Generation

The WSO2 API Manager developer portal accepts user-supplied input without enforcing expected validation constraints or proper output encoding. This deficiency allows a malicious actor to inject script content that is executed within the context of a user's browser. By leveraging this cross-site...

WSO2 Identity Server and WSO2 API Manager Developer Portal security vulnerabilities

WSO2 Identity Server IS and WSO2 API Manager Developer Portal are both products of the American company WSO2. WSO2 Identity Server is an identity authentication server. WSO2 API Manager Developer Portal is a developer portal platform. Both WSO2 Identity Server and WSO2 API Manager Developer Porta...