CVE-2026-111089

Apache Wicket versions 8.0.0 through 8.19.0 , 9.0.0 through 9.24.0 , and 10.0.0 through 10.11.0 are vulnerable to Cross-Site Scripting (XSS) . The root cause is the framework's failure to escape resource bundle texts (such as localized labels or CSS class names) when they are written into generat...