CVE-2026-76985: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Software Foundation Apache Wicket

The vulnerability exists in Apache Wicket's Palette component, specifically in the AbstractOptions class that renders option lists. While the id and display values are escaped according to the escape-model-strings setting, attribute names and values returned by overridden methods getAdditionalAttributesForChoices, getAdditionalAttributesForSelection, or AbstractOptions.getAdditionalAttributes are written directly into the <option> tag without escaping. If an application overrides these methods and returns attacker-influenced data, it can lead to cross-site scripting. By default, these methods return null, so applications not overriding them are not affected. The issue affects Apache Wicket versions 8.0.0 through 8.18.0, 9.0.0 through 9.23.0, and 10.0.0 through 10.10.0. Upgrading to versions 8.19.0, 9.24.0, or 10.11.0 addresses the vulnerability.

An attacker can exploit this vulnerability to inject malicious scripts into web pages generated by Apache Wicket applications that override the specified methods and do not properly escape input. This can lead to cross-site scripting attacks, potentially allowing attackers to execute arbitrary scripts in the context of the affected application. The CVSS 4.0 base score is 5.1 (medium), indicating a moderate impact with network attack vector, low complexity, and requiring user interaction.

Users should upgrade affected Apache Wicket versions to 8.19.0, 9.24.0, or 10.11.0 where the issue is fixed. As a workaround, applications overriding the affected methods should ensure that any data returned is properly escaped before being written into the <option> tag attributes. No vendor advisory is provided, so patch status is inferred from the description; users should verify with official Apache Wicket release notes for confirmation.