Here's a simple method to unescape XML. It handles the predefined XML entities and decimal numerical entities (&#nnnn;). Modifying it to handle hex entities (&#xhhhh;) should be simple.

public static String unescapeXML( final String xml )
{
    Pattern xmlEntityRegex = Pattern.compile( "&(#?)([^;]+);" );
    //Unfortunately, Matcher requires a StringBuffer instead of a StringBuilder
    StringBuffer unescapedOutput = new StringBuffer( xml.length() );

    Matcher m = xmlEntityRegex.matcher( xml );
    Map<String,String> builtinEntities = null;
    String entity;
    String hashmark;
    String ent;
    int code;
    while ( m.find() ) {
        ent = m.group(2);
        hashmark = m.group(1);
        if ( (hashmark != null) && (hashmark.length() > 0) ) {
            code = Integer.parseInt( ent );
            entity = Character.toString( (char) code );
        } else {
            //must be a non-numerical entity
            if ( builtinEntities == null ) {
                builtinEntities = buildBuiltinXMLEntityMap();
            }
            entity = builtinEntities.get( ent );
            if ( entity == null ) {
                //not a known entity - ignore it
                entity = "&" + ent + ';';
            }
        }
        m.appendReplacement( unescapedOutput, entity );
    }
    m.appendTail( unescapedOutput );

    return unescapedOutput.toString();
}

private static Map<String,String> buildBuiltinXMLEntityMap()
{
    Map<String,String> entities = new HashMap<String,String>(10);
    entities.put( "lt", "<" );
    entities.put( "gt", ">" );
    entities.put( "amp", "&" );
    entities.put( "apos", "'" );
    entities.put( "quot", "\"" );
    return entities;
}

The list of all HTML named character references is available at http://www.whatwg.org/specs/web-apps/current-work/multipage/entities.json

If you can tolerate the occasional mistake, you could just go over that file and replace all named character references that are not allowed in stand-alone XML with the corresponding numeric character reference.

That simple approach can run into problems though if your input is HTML, not XHTML:

<script>var y=1, lt = 3, x = y&lt; alert(x);</script>

contains a script element whose content is not encoded using entities, so naively replacing the < here will break the script. There are other elements like <xmp> and <style> that can have similar problems as will CDATA sections in foreign XML elements.

If you need a really faithful conversion, or if your HTML is messy, your best bet might be to parse the HTML to a DOM using something like nu.validator and then use How to pretty print XML from Java? to convert the DOM to valid XML.

Even if your input is XHTML, you might need to worry about character sequences that look like entities in CDATA sections. Again, parse and re-render might be your best option.