Acknowledged by WSO2

I was able to bypass their XSS filter. After responsibly disclosing the vulnerability I got acknowledged.
https://docs.wso2.com/display/Security/Acknowledgments