CVE-2026-76983

Name of the Vulnerable Software and Affected Versions Apache Wicket versions 1.5.0 through 8.18.0 Apache Wicket versions 9.0.0 through 9.23.0 Apache Wicket versions 10.0.0 through 10.10.0

Description Improper neutralization of input during web page generation occurs via the <wicket:label> tag provided by org.apache.wicket.markup.html.form.AutoLabelTextResolver. The resolver writes labels into the markup without escaping, causing any markup within a label to be rendered as active markup. This occurs when the label of a form component, set through FormComponent#setLabel(IModel), contains data that can be influenced by an attacker.

Recommendations Upgrade to version 8.19.0 Upgrade to version 9.24.0 Upgrade to version 10.11.0