CVE-2026-75802: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Software Foundation Apache Wicket

The vulnerability (CVE-2026-75802) in Apache Wicket arises because AjaxEditableChoiceLabel, when constructed with a non-null IChoiceRenderer, writes the display value from the renderer into the label's markup without applying the default HTML escaping. This improper neutralization of input during web page generation (CWE-79) enables cross-site scripting attacks if an attacker can control the choice or model data. Additionally, AjaxEditableLabel, AjaxEditableChoiceLabel, and AjaxEditableMultiLineLabel write the value from the defaultNullLabel() method into the markup without escaping when the model is empty, which can also be exploited if the method is overridden with attacker-controlled data. The vulnerability affects Apache Wicket versions from 8.0.0 through 8.18.0, 9.0.0 through 9.23.0, and 10.0.0 through 10.10.0. The issue is resolved in versions 8.19.0, 9.24.0, and 10.11.0.

Successful exploitation allows an attacker to inject arbitrary HTML or JavaScript into web pages rendered by Apache Wicket, leading to cross-site scripting attacks. This can result in script execution in the browsers of users who view the affected pages, potentially compromising user data or session information. The CVSS 4.0 score is 5.1 (medium severity), reflecting network attack vector, low attack complexity, and requiring user interaction with limited privileges.

Users should upgrade Apache Wicket to versions 8.19.0, 9.24.0, or 10.11.0 or later, where this vulnerability is fixed. No other configuration or workaround is indicated as effective because the escapeModelStrings setting does not affect the vulnerable components. Patch status is not explicitly stated in the vendor advisory fields but the description clearly recommends upgrading to these fixed versions.