Apache Wicket versions from 8.0.0 through 8.17.0, 9.0.0 through 9.22.0, and 10.0.0 through 10.8.0 contain a Cross-site Scripting (XSS) vulnerability. This flaw involves improper neutralization of input during web page generation, which can lead to reflected XSS attacks. The issue is fixed in version 10.9.0, and users are advised to upgrade to this version to mitigate the vulnerability.