This vulnerability in WSO2 API Control Plane is due to improper neutralization of input during web page generation (CWE-79). Specifically, the Publisher Portal and Developer Portal do not adequately sanitize HTML input, allowing malicious JavaScript injection in API documentation views. Exploitation results in script execution within the user's browser session, which could lead to unauthorized actions based on the user's permissions. The issue affects multiple versions prior to specific patch releases, indicating that fixes have been made in later versions.

Successful exploitation allows attackers to execute arbitrary JavaScript in the context of users viewing API documentation, potentially enabling actions on behalf of those users depending on their session privileges. This can lead to information disclosure or unauthorized operations within the affected portals. The impact is limited to users who have permission to access the API documentation through the Publisher or Developer Portals.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should verify with WSO2 for official fixes or updates addressing this vulnerability. Until patches are applied, restrict access to the affected portals to trusted users and consider additional input validation or content security policies to mitigate risk.