Cross Site Scripting

Apache Wicket is vulnerable to Cross Site Scripting. The vulnerability is due to failure to escape the default option value in AbstractSingleSelectChoice during markup generation, where the body is taken from getNullValidDisplayValue or getNullKeyDisplayValue and inserted unescaped, allowing an...