WSO2 API Manager Carbon interface version 3.0.0 suffers from a persistent cross site scripting vulnerability.