Skip to main content

Apache Wicket CVE-2026-75802

| EUVDEUVD-2026-68488 MEDIUM
Cross-site Scripting (XSS) (CWE-79)
2026-08-31 GHSA-hx44-pxvx-pqrv
XSS Apache Wicket
5.1
CVSS 4.0 · Vendor
Share

Severity by source

Vendor (CNA) PRIMARY
5.1 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber
vuln.today AI
5.4 MEDIUM

Network XSS requiring attacker influence over application data (PR:L) and victim page view (UI:R); scope changes as injected script runs in victim browser context.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (CNA).

CVSS VectorVendor

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
P
Scope
X

Lifecycle Timeline

3
CVSS changed
Aug 31, 2026 - 12:22 NVD
5.1 (MEDIUM)
CVE Published
Aug 31, 2026 - 10:50 cve.org
MEDIUM
Analysis Generated
Aug 31, 2026 - 08:18 vuln.today

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

AnalysisAI

Cross-site scripting vulnerabilities in Apache Wicket's AjaxEditableChoiceLabel and related wicket-extensions components allow an attacker who can influence rendered choice or model data to inject arbitrary HTML or JavaScript into page markup, executing in the browser of any user viewing the affected page. Versions 8.0.0 through 8.18.0, 9.0.0 through 9.23.0, and 10.0.0 through 10.10.0 of the org.apache.wicket:wicket-extensions module are confirmed affected. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Persist
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation of the IChoiceRenderer path requires: (1) the application instantiates AjaxEditableChoiceLabel with a non-null custom IChoiceRenderer implementation, and (2) an attacker can influence the data from which that renderer derives its getDisplayValue() output - for example, via a form submission or API call that persists data into the choice list. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The vendor categorizes this as moderate severity, which is consistent with a conditional XSS whose exploitability depends on application-specific configuration choices rather than default framework behavior. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Upgrade to Apache Wicket 8.19.0, 9.24.0, or 10.11.0, the vendor-confirmed fixed releases for the 8.x, 9.x, and 10.x branches respectively; these versions apply correct HTML escaping to both the IChoiceRenderer display value path and the defaultNullLabel() return value. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Wicket

View all
CVE-2015-5347 MEDIUM POC
6.1 Apr 12

Cross-site scripting (XSS) vulnerability in the getWindowOpenJavaScript function in org.apache.wicket.extensions.ajax.ma
CVE-2016-6793 CRITICAL
9.1 Jul 17

The DiskFileItem class in Apache Wicket 6.x before 6.25.0 and 1.5.x before 1.5.17 allows remote attackers to cause a den
CVE-2024-36522 CRITICAL
9.8 Jul 12

The default configuration of XSLTResourceStream.java is vulnerable to remote code execution via XSLT injection when proc
CVE-2016-6806 HIGH
8.8 Oct 03

Apache Wicket 6.x before 6.25.0, 7.x before 7.5.0, and 8.0.0-M1 provide a CSRF prevention measure that fails to discover
CVE-2014-3526 HIGH
7.5 Oct 30

Apache Wicket before 1.5.12, 6.x before 6.17.0, and 7.x before 7.0.0-M3 might allow remote attackers to obtain sensitive
CVE-2014-7808 HIGH
7.5 Sep 15

Apache Wicket before 1.5.13, 6.x before 6.19.0, and 7.x before 7.0.0-M5 make it easier for attackers to defeat a cryptog
CVE-2026-71257 HIGH
7.5 Aug 30

Per-file size and file-count upload limit enforcement in Apache Wicket 8.x through 10.x can be bypassed when a co-deploy
CVE-2021-23937 HIGH
7.5 May 25

A DNS proxy and possible amplification attack vulnerability in WebClientInfo of Apache Wicket allows an attacker to trig
CVE-2020-11976 HIGH
7.5 Aug 11

By crafting a special URL it is possible to make Wicket deliver unprocessed HTML templates. Rated high severity (CVSS 7.
CVE-2024-27439 MEDIUM
6.5 Mar 19

An error in the evaluation of the fetch metadata headers could allow a bypass of the CSRF protection in Apache Wicket.1.
CVE-2012-5636 MEDIUM
6.1 Oct 30

Cross-site scripting (XSS) vulnerability in Apache Wicket 1.4.x before 1.4.22, 1.5.x before 1.5.10, and 6.x before 6.4.0
CVE-2015-7520 MEDIUM
6.1 Apr 12

Multiple cross-site scripting (XSS) vulnerabilities in the (1) RadioGroup and (2) CheckBoxMultipleChoice classes in Apac

Same weakness CWE-79 – Cross-site Scripting (XSS)

View all
CVE-2020-3580 MEDIUM POC
6.1
CVE-2013-7389 MEDIUM POC
4.3
CVE-2021-25299 MEDIUM POC
6.1
CVE-2014-2120 MEDIUM
6.1
CVE-2023-40000 HIGH POC
8.3
CVE-2016-8581 MEDIUM POC
6.1
CVE-2013-5223 MEDIUM POC
5.4
CVE-2025-52367 MEDIUM POC
5.4

Same technique XSS

View all
CVE-2017-9248 CRITICAL POC
9.8
CVE-2020-3580 MEDIUM POC
6.1
CVE-2013-1710 CRITICAL POC
10.0
CVE-2013-7389 MEDIUM POC
4.3
CVE-2021-25299 MEDIUM POC
6.1
CVE-2014-2120 MEDIUM
6.1
CVE-2023-40000 HIGH POC
8.3
CVE-2024-52875 HIGH POC
8.8

Share

CVE-2026-75802 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy