EUVD-2026-114903

Improper neutralization of input during web page generation in Apache Wicket. Apache Wicket generates JavaScript that refers to the elements it renders, and writes into that JavaScript two values it derives itself: a component's markup id, and the input name of a form component, which is built fr...

EUVD-2026-114904

Apache Wicket reads texts from the application's resource bundles — a localized label, a css class name — and writes some of them into the JavaScript and the markup it generates for a component. Those texts are placed inside single-quoted JavaScript string literals and inside quoted attribute...

CVE-2026-111089

Apache Wicket versions 8.0.0 through 8.19.0 , 9.0.0 through 9.24.0 , and 10.0.0 through 10.11.0 are vulnerable to Cross-Site Scripting (XSS) . The root cause is the framework's failure to escape resource bundle texts (such as localized labels or CSS class names) when they are written into generat...

CVE-2026-95863

Apache Wicket is vulnerable to Cross-Site Scripting (XSS) due to improper neutralization of input during web page generation. The software fails to escape markup IDs and component IDs when they are written into generated JavaScript string literals. This allows an attacker to break out of the lite...

Cross-Site Scripting (XSS)

org.apache.wicket, wicket-extensions is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to AjaxEditableChoiceLabel and related components writing attacker-influenced renderer or overridden defaultNullLabel values directly into the page markup without HTML escaping, which allows a...

Cross-site Scripting (XSS)

Overview org.apache.wicket:wicket-extensions is a rich component library for the Wicket framework. Affected versions of this package are vulnerable to Cross-site Scripting XSS through the AjaxEditableLabel, AjaxEditableChoiceLabel, and AjaxEditableMultiLineLabel rendering paths in...

be.personify.iam:personify-frontend (>=1.3.1.release, <=1.4.2.release), com.giffing.wicket.spring.boot.starter:wicket-spring-boot-starter (>=3.0.1-rc, <=3.1.7) +177 more potentially affected by CVE-2026-75802 via org.apache.wicket:wicket-extensions (>=9.0.0-m1, <=9.23.0)

org.apache.wicket:wicket-extensions MAVEN version =9.0.0-m1, =1.3.1.release, =3.0.1-rc, =9.0.0-m2, =9.0.0-m2, =9.0.0-m2, =9.0.0-m2, =9.0.0-m3, =9.0.0-m2, =9.0.0-m2, =9.0.0-m2, =9.0.0-m2, =9.0.0-m2, =9.0.0-m2, =9.0.0-m2, =9.23.1...

be.personify.iam:personify-frontend (>=1.5.1.release, <=1.5.8.release), com.giffing.wicket.spring.boot.starter:wicket-spring-boot-starter (>=4.0.0-m1, <=5.0.0) +188 more potentially affected by CVE-2026-75802 via org.apache.wicket:wicket-extensions (>=10.0.0-m1, <=10.10.0)

org.apache.wicket:wicket-extensions MAVEN version =10.0.0-m1, =1.5.1.release, =4.0.0-m1, =5.0.0 - com.googlecode.wicket-jquery-ui:wicket-jquery-ui 10.0.0-m1 - com.googlecode.wicket-jquery-ui:wicket-jquery-ui-calendar 10.0.0-m1 - com.googlecode.wicket-jquery-ui:wicket-jquery-ui-core 10.0.0-m1 -...

be.personify.iam:personify-frontend (>=1.3.1.release, <=1.4.2.release), com.giffing.wicket.spring.boot.starter:wicket-spring-boot-starter (>=3.0.1-rc, <=3.1.7) +177 more potentially affected by CVE-2026-76985 via org.apache.wicket:wicket-extensions (>=9.0.0-m1, <=9.23.0)

org.apache.wicket:wicket-extensions MAVEN version =9.0.0-m1, =1.3.1.release, =3.0.1-rc, =9.0.0-m2, =9.0.0-m2, =9.0.0-m2, =9.0.0-m2, =9.0.0-m3, =9.0.0-m2, =9.0.0-m2, =9.0.0-m2, =9.0.0-m2, =9.0.0-m2, =9.0.0-m2, =9.0.0-m2, =9.23.1...

Cross-site Scripting (XSS)

Overview org.apache.wicket:wicket-extensions is a rich component library for the Wicket framework. Affected versions of this package are vulnerable to Cross-site Scripting XSS through org.apache.wicket.extensions.markup.html.form.palette.component.AbstractOptions in the palette option-rendering...

com.angkorteam.framework.extension:framework-extension (>=3.0.0, <=3.0.2), com.coderdreams:wicket-fields (1.0.0) +190 more potentially affected by CVE-2026-76985 via org.apache.wicket:wicket-extensions (>=8.0.0, <=8.18.0)

org.apache.wicket:wicket-extensions MAVEN version =8.0.0, =3.0.0, =1.1.0, =2.1.1, =2.1.1, =8.0.0, =8.0.0, =8.0.0, =8.0.0, =8.0.0, =8.0.0, =8.0.0, =8.0.0, =8.0.0, =8.14.0 and more Source cves: CVE-2026-76985 Source advisory: MEND:CVE-2026...

be.personify.iam:personify-frontend (>=1.3.1.release, <=1.4.2.release), com.giffing.wicket.spring.boot.starter:wicket-spring-boot-starter (>=3.0.4, <=3.1.7) +176 more potentially affected by CVE-2026-76985 via org.apache.wicket:wicket-extensions (>=9.0.0, <=9.23.0)

org.apache.wicket:wicket-extensions MAVEN version =9.0.0, =1.3.1.release, =3.0.4, =9.0.0, =9.0.0, =9.0.0, =9.0.0, =9.0.0, =9.0.0, =9.0.0, =9.0.0, =9.0.0, =9.0.0, =9.0.0, =9.23.1 and more Source cves: CVE-2026-76985https://vulne...

be.personify.iam:personify-frontend (>=1.5.4.release, <=1.5.8.release), com.giffing.wicket.spring.boot.starter:wicket-spring-boot-starter (>=4.0.0, <=5.0.0) +130 more potentially affected by CVE-2026-76985 via org.apache.wicket:wicket-extensions (>=10.0.0, <=10.10.0)

org.apache.wicket:wicket-extensions MAVEN version =10.0.0, =1.5.4.release, =4.0.0, =1.0.0, =7.0.3, =7.0.3, =7.0.11, =7.0.3, =0.1.0, =10.2.0, =10.2.0, =0.1.0, =2.4.1, =2.5.0 - jp.try0.wicket:wicket-toastr-samples 3.0.0 and more Source cves: CVE-2026-76985 Source advisory: MEND:CVE-2026-76985...

CVE-2026-75802 Apache Wicket: XSS in AjaxEditableLabel and its subclasses via IChoiceRenderer and defaultNullLabel

AjaxEditableChoiceLabel in wicket-extensions, when constructed with a non-null IChoiceRenderer, writes the display value obtained from that renderer into the label's markup without applying the HTML escaping Wicket performs by default for component model values. An attacker who can influence the...

be.personify.iam:personify-frontend (>=1.5.4.release, <=1.5.8.release), com.giffing.wicket.spring.boot.starter:wicket-spring-boot-starter (>=4.0.0, <=5.0.0) +130 more potentially affected by CVE-2026-75802 via org.apache.wicket:wicket-extensions (>=10.0.0, <=10.10.0)

org.apache.wicket:wicket-extensions MAVEN version =10.0.0, =1.5.4.release, =4.0.0, =1.0.0, =7.0.3, =7.0.3, =7.0.11, =7.0.3, =0.1.0, =10.2.0, =10.2.0, =0.1.0, =2.4.1, =2.5.0 - jp.try0.wicket:wicket-toastr-samples 3.0.0 and more Source cves: CVE-2026-75802 Source advisory: MEND:CVE-2026-75802...

EUVD-2026-68488

AjaxEditableChoiceLabel in wicket-extensions, when constructed with a non-null IChoiceRenderer, writes the display value obtained from that renderer into the label's markup without applying the HTML escaping Wicket performs by default for component model values. An attacker who can influence the...

CVE-2026-75802 Apache Wicket: XSS in AjaxEditableLabel and its subclasses via IChoiceRenderer and defaultNullLabel

AjaxEditableChoiceLabel in wicket-extensions, when constructed with a non-null IChoiceRenderer, writes the display value obtained from that renderer into the label's markup without applying the HTML escaping Wicket performs by default for component model values. An attacker who can influence the...

PT-2026-83793

Name of the Vulnerable Software and Affected Versions Apache Wicket versions 8.0.0 through 8.18.0 Apache Wicket versions 9.0.0 through 9.23.0 Apache Wicket versions 10.0.0 through 10.10.0 Apache Wicket versions 6.22.0 and earlier Apache Wicket versions 1.4.0 and earlier Description Cross-site...

Cross-site Scripting (XSS)

Overview org.apache.wicket:wicket-extensions is a rich component library for the Wicket framework. Affected versions of this package are vulnerable to Cross-site Scripting XSS via improper neutralization of JavaScript in PopupSettings.java‎, Link.java, and ExternalLink.java markup. An attacker ca...

de.wicketbuch.extensions:extensible-autolinking (>=1.2.0.wicket6, <=1.3.0.wicket6), de.wicketbuch.extensions:extensible-autolinking-examples (>=1.2.0.wicket6, <=1.3.0.wicket6) +20 more potentially affected by CVE-2021-23937 via org.apache.wicket:wicket-core (6.27.1)

org.apache.wicket:wicket-core MAVEN version 6.27.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.wicket:wicket-core and may be impacted: - de.wicketbuch.extensions:extensible-autolinking =1.2.0.wicket6, =1.2.0.wicket6, =1.3.0.wicket6 -...