Apache Wicket CVE-2026-76982

Exploitation requires two simultaneous application-level conditions: (1) the application renders a Button, AjaxButton, AjaxFallbackButton, or WizardButton component bound to a <button> HTML element - not the default <input> rendering - and (2) the button's model object is populated with data an attacker can influence, such as a stored user-submitted value or a request parameter reflected into the model. The flaw is NOT exploitable when buttons render as <input> elements (the more common case), when model content is entirely under developer control, or when setEscapeModelStrings(true) is explicitly called on the component. No CVSS vector was provided in the input data, so authentication requirements for the attacker cannot be confirmed from available signals; the attacker's exploitation path depends entirely on how the application populates the button's model.

Risk is conditional and lower than a typical network-exploitable XSS. Two simultaneous application-level prerequisites narrow the exploitable surface: the developer must have chosen to bind a Button to a <button> HTML element rather than the default <input> rendering, and the button's model must be populated with attacker-controllable data. Many Wicket deployments will meet neither condition. No CVSS vector was provided, so attack metrics are inferred from the description rather than confirmed; no EPSS score is available to quantify exploitation probability, and the vulnerability does not appear in the CISA KEV catalog. Apache's own 'moderate' severity rating aligns with the conditional exploitability profile. The XSS impact class - session hijacking, credential theft, malicious redirects - is real and well-understood, meaning that organizations whose Wicket applications do render user-supplied data through Button models on <button> elements should prioritize patching regardless of the overall moderate rating.

An attacker submits malicious JavaScript (e.g., a script tag redirecting to a credential-harvesting site) as a value stored in the application database and later bound as the model for an AjaxButton or WizardButton rendered on a <button> element. When a legitimate user loads the affected page, the unencoded payload executes in their browser context, enabling session token theft or arbitrary page manipulation. No public proof-of-concept code is known at time of analysis, so exploitation requires attacker knowledge of this flaw and a reachable injection point in the target application.