CVE-2026-76983
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk41th percentile - higher than 41% of all known CVEs
Summary
In Apache Wicket, the <wicket:label> tag is rendered without escaping, allowing HTML injection if the label comes from a model containing attacker-controlled data. Affects versions from 8.0.0 through 8.18.0, 9.0.0 through 9.23.0, and 10.0.0 through 10.10.0.
Risk Assessment
If form component labels contain user-supplied data, an attacker could inject malicious HTML, potentially leading to XSS attacks or page content manipulation.
Recommendation
Upgrade to version 8.19.0, 9.24.0, or 10.11.0 which contain the fix. There is no workaround, so upgrading is necessary.
Other vulnerabilities in Apache Wicket
See all- CVE-2026-43646High
Apache Wicket has a vulnerability that exposes sensitive information to unauthorized actors. This affects versions from 8.0.0 to 8.17.0, from 9.0.0 to 9.22.0, and from 10.0.0 to 10.8.0.
- CVE-2014-3526High
Apache Wicket before 1.5.12, 6.x before 6.17.0, and 7.x before 7.0.0-M3 might allow remote attackers to obtain sensitive information via identifiers for storing page markup for temporary user sessions.
- CVE-2016-6806High
Apache Wicket versions 6.x before 6.25.0, 7.x before 7.5.0, and 8.0.0-M1 contain a security vulnerability that improperly handles CSRF prevention, failing to detect some cross-origin requests. The issue also involves not checking all Wicket server-side targets.
- CVE-2014-7808High
Apache Wicket before 1.5.13, 6.x before 6.19.0, and 7.x before 7.0.0-M5 make it easier for attackers to defeat a cryptographic protection mechanism and predict encrypted URLs by leveraging use of CryptoMapper as the default encryption provider.
- CVE-2016-6793Critical
The DiskFileItem class in Apache Wicket 6.x before 6.25.0 and 1.5.x before 1.5.17 allows remote attackers to cause a denial of service (infinite loop) and write to, move, and delete files with the permissions of DiskFileItem. Additionally, if running on a Java VM before 1.3.1, it can execute arbitrary code via a crafted serialized Java object.
- CVE-2026-76986Medium
A cross-site scripting (XSS) vulnerability was found in Apache Wicket in AbstractSingleSelectChoice (base class of DropDownChoice). The default option body is written without escaping, while other options are escaped. Applications overriding getNullValidDisplayValue() or getNullKeyDisplayValue() with attacker-influenced data are affected. Versions 8.0.0-8.18.0, 9.0.0-9.23.0, 10.0.0-10.10.0 are affected.
- CVE-2026-76985Medium
A cross-site scripting (XSS) vulnerability was found in Apache Wicket in AbstractOptions (renders option lists in Palette). Attribute names and values from getAdditionalAttributes are written without escaping. Applications overriding getAdditionalAttributesForChoices, getAdditionalAttributesForSelection, or getAdditionalAttributes with attacker-influenced data are affected. Versions 8.0.0-8.18.0, 9.0.0-9.23.0, 10.0.0-10.10.0 are affected.
- CVE-2026-76984Medium
In Apache Wicket, the MetaDataHeaderItem component improperly neutralizes input during web page generation. Attribute values in <meta> and <link> tags are not properly escaped, allowing injection of additional attributes. Affects versions from 8.0.0 through 8.18.0, 9.0.0 through 9.23.0, and 10.0.0 through 10.10.0.
- CVE-2026-76982Medium
XSS vulnerability in Apache Wicket affects the Button component rendered as a <button> element. The constructor clears the escape-model-strings flag, so the model is not encoded when written to the element body, allowing markup injection.
- CVE-2026-75802Medium
XSS vulnerability in Apache Wicket affects AjaxEditableChoiceLabel, AjaxEditableLabel, and AjaxEditableMultiLineLabel components. Displayed label values are not properly escaped, allowing an attacker to inject HTML or scripts. Affected versions: 8.0.0-8.18.0, 9.0.0-9.23.0, 10.0.0-10.10.0.
Original NVD description (English source)
Improper neutralization of input during web page generation in Apache Wicket. The <wicket:label> tag is provided by org.apache.wicket.markup.html.form.AutoLabelTextResolver, which is registered by default in every WebApplication. The resolver writes the label it finds into the markup as it is, and reads no escaping setting at all, so markup in a label is rendered as markup. When the label comes from the labelled component's label model, set through FormComponent#setLabel(IModel), it is written to the markup unescaped. An application is affected where the label of a form component holds data an attacker can influence. Wicket cannot determine where a model value comes from, so whether it reaches the page from a request or from storage is a property of the application. There is no workaround. Unlike every other rendering path in Wicket, the resolver never consulted the escape-model-strings setting, so an application had no way to ask for the label to be escaped. The body of a <wicket:label> tag is markup by design and is not affected; it remains the supported way to place markup in a label. This issue affects Apache Wicket: from 8.0.0 through 8.18.0, from 9.0.0 through 9.23.0, from 10.0.0 through 10.10.0. Older, unsupported releases from 1.5.0 onwards are also affected. Users are recommended to upgrade to version 8.19.0, 9.24.0 or 10.11.0, which fix the issue.