CVE-2026-76982: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Software Foundation Apache Wicket

Apache Wicket's Button component disables escaping of model strings for attribute values to avoid double encoding, but when rendering as a <button> element, it writes the model content into the element body without encoding. This improper neutralization of input during web page generation leads to a cross-site scripting vulnerability (CWE-79) if the model data can be attacker-controlled. The flaw affects Apache Wicket versions 8.0.0 through 8.18.0, 9.0.0 through 9.23.0, and 10.0.0 through 10.10.0, including older unsupported releases from 6.25.0 and 7.5.0 onwards. The vulnerability impacts Button and its subclasses AjaxButton, AjaxFallbackButton, and WizardButton. The recommended fix is to upgrade to versions 8.19.0, 9.24.0, or 10.11.0 where the issue is resolved. Alternatively, a workaround is to call setEscapeModelStrings(true) on buttons rendered as <button> elements to ensure proper escaping without double encoding.

An attacker who can influence the model data rendered inside a <button> element can inject malicious markup, leading to cross-site scripting (XSS). This can result in execution of arbitrary scripts in the context of the affected web application, potentially compromising user sessions or performing unauthorized actions. The vulnerability requires that the application renders a Button on a <button> element and that the model data is attacker-controllable. The CVSS 4.0 score is 5.1 (medium severity), reflecting network attack vector, low attack complexity, no privileges required but user interaction needed, and limited scope and impact.

Users should upgrade Apache Wicket to versions 8.19.0, 9.24.0, or 10.11.0 where this vulnerability is fixed. As a workaround, calling setEscapeModelStrings(true) on Button components rendered as <button> elements will correctly escape the element body and prevent XSS without causing double encoding. No other official remediation level or patch information is provided, so users should rely on upgrading or applying the workaround.