I think it will be helpful if I add a comment to this answer, including the current state.
Adaptive-Chosen Ciphertext Attacks:
The attacks applied on XML Encryption are adaptive chosen-ciphertext attacks. In an adaptive chosen-ciphertext attack scenario the attacker takes the original ciphertext, modifies it, and sends to the server. He then evaluates the server response, which allows him to decide if the underlying plaintext was valid or not. He repeats this several times which allows him to decrypt the whole message.
These attacks are e.g. applicable to CBC schemes (Cipher Block Chaining mode of operation), which is still standardized by XML Encryption or many other standards. CBC (AES-CBC or 3DES-CBC) allows to modify plaintexts in the ciphertext, without knowing the encryption key. More specifically, the attacker is able to flip specific bits in the plaintext (I am not going into details, please read the paper or the blogpost by Matt Green mentioned in the first answer). If certain bits in the plaintext are flipped, the attacker produces a message, which can not be processed by XML parser. Other bits result in valid plaintexts.
There are two prerequisites for executing the attack. First, the attacker has to be able to modify the ciphertexts and force the server to process them. Second, the attacker has to have an information if the decrypted modified ciphertext was valid or not. This is typically possible since the server responds with a different error message if the modified ciphertext was valid and with a different message if it was invalid (there are also other ways to distinguish valid or invalid messages, e.g. by measuring response times).
Ok, but XML Signatures should secure integrity...
Yes, we have the XML Signature standard which allows to secure integrity of the XML messages. This theoretically mitigates the attacks since the ciphertexts can be signed. This prevents ciphertext modification (the first attack prerequisite).
However, in all the tested frameworks, it was possible to apply this attack even if XML Signatures were applied. In short, a typical XML Signature secures only a part of an XML message. We were able to place the modified ciphertexts into parts, which were not signed. Even if they were not signed, the frameworks processed and decrypted them.
This was not considered by the XML Encryption standard and is now addressed in the newest version, including a secure encryption scheme AES-GCM: http://www.w3.org/TR/xmlenc-core1/
Frameworks we analyzed:
We analyzed some frameworks and found out they were vulnerable to the attacks. For example Apache Axis2, JBossWS, Apache CXF, or some SAML frameworks. The attacks worked, even if the XML Signatures were used.
As mentioned in the first answer, there are several countermeasures listed in the newest standard. If you design or use XML Security, your server should carefully check if the ciphertexts were signed. If the message contains an unsigned ciphertext, the message should be rejected. This is how it was implemented now in Apache CXF. Another possibility is to use AES-GCM...
For more information, you can take a look at my thesis, which summarizes all the attacks (including attacks on RSA PKCS#1 v1.5) and provides several countermesures: http://www.nds.rub.de/research/publications/xmlinsecurity/
With the presented countermeasures, it is possible to deploy a system secure against adaptive chosen-ciphertext attacks. We did several pentests and we saw many systems, where we were not able to apply these attacks.
I think XML Encryption (together with XML Signature) is a great standard supporting so many confidentiality scenarios. But you have to pay attention how you configure your system (I am not sure the frameworks are secure by default).
We released a plugin for our WS-Attacker framework to test for vulnerabilities in Web Services using XML Encryption: http://web-in-security.blogspot.de/2015/05/how-to-attack-xml-encryption-in-ibm.html