CVE-2026-95863

Apache Wicket is vulnerable to Cross-Site Scripting (XSS) due to improper neutralization of input during web page generation. The software fails to escape markup IDs and component IDs when they are written into generated JavaScript string literals. This allows an attacker to break out of the lite...