In WSO2 Enterprise Integrator 6.5.0, reflected XSS occurs when updating the message processor configuration from the source view in the Management Console.
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-9204
https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2019-0658