CVE-2025-10853 is a reflected cross-site scripting (XSS) vulnerability found in the management console of multiple WSO2 products. It arises from improper output encoding of specific parameters, allowing an attacker to inject arbitrary JavaScript into the response. Exploitation can lead to UI manipulation, redirection to malicious sites, or theft of browser data. The risk of session hijacking is mitigated by the use of the httpOnly flag on session cookies.