CVE-2026-75802

Name of the Vulnerable Software and Affected Versions Apache Wicket versions 8.0.0 through 8.18.0 Apache Wicket versions 9.0.0 through 9.23.0 Apache Wicket versions 10.0.0 through 10.10.0 Apache Wicket versions 6.22.0 and earlier Apache Wicket versions 1.4.0 and earlier

Description Cross-site scripting is possible in AjaxEditableChoiceLabel within wicket-extensions when used with a non-null IChoiceRenderer. The component writes the display value from the renderer into the markup without applying default HTML escaping. Additionally, AjaxEditableLabel, AjaxEditableChoiceLabel, and AjaxEditableMultiLineLabel fail to escape values returned by the defaultNullLabel() method when the model is empty. This allows an attacker who can influence the choice, model data, or the overridden defaultNullLabel() method to inject HTML or scripts into the browser of users viewing the page. The escapeModelStrings configuration does not mitigate this issue as it is not passed to the underlying label.

Recommendations Upgrade versions 8.0.0 through 8.18.0 to 8.19.0. Upgrade versions 9.0.0 through 9.23.0 to 9.24.0. Upgrade versions 10.0.0 through 10.10.0 to 10.11.0.