Skip to main content

Apache Wicket CVE-2026-76984

| EUVDEUVD-2026-68490 MEDIUM
Cross-site Scripting (XSS) (CWE-79)
2026-08-31 GHSA-f53h-v4wv-fq5x
Apache XSS Wicket
5.1
CVSS 4.0 · Vendor
Share

Severity by source

Vendor (CNA) PRIMARY
5.1 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber
vuln.today AI
4.7 MEDIUM

AC:H reflects required application-level coupling (attacker data must reach MetaDataHeaderItem APIs); UI:R for victim page load; S:C for XSS browser scope change; no availability impact.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
4.0 AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (CNA).

CVSS VectorVendor

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
P
Scope
X

Lifecycle Timeline

3
CVSS changed
Aug 31, 2026 - 12:22 NVD
5.1 (MEDIUM)
CVE Published
Aug 31, 2026 - 10:50 cve.org
CRITICAL
Analysis Generated
Aug 31, 2026 - 08:16 vuln.today

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

AnalysisAI

Cross-site scripting in Apache Wicket's MetaDataHeaderItem class allows injection of arbitrary HTML attributes into generated <meta> and <link> header tags when applications pass attacker-influenced data to the addTagAttribute, forMetaTag, or forLinkTag APIs. The flawed escaping logic - replacing double-quote characters with backslash-double-quote, which carries no escaping semantics in HTML - permits a double-quote in an attacker-controlled value to break out of the attribute context and inject additional attributes such as JavaScript event handlers. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Persist
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires that the target application passes attacker-influenced data to org.apache.wicket.markup.head.MetaDataHeaderItem via the addTagAttribute method or the forMetaTag and forLinkTag factory methods, where that data reaches a tag attribute value position. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment Real-world risk is moderate and strongly application-dependent: only deployments that pass externally influenced data into MetaDataHeaderItem via addTagAttribute, forMetaTag, or forLinkTag are exploitable - applications using only developer-controlled literal values are unaffected. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Upgrade to the vendor-released patched versions: Apache Wicket 8.19.0, 9.24.0, or 10.11.0 for the corresponding release branch. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Wicket

View all
CVE-2015-5347 MEDIUM POC
6.1 Apr 12

Cross-site scripting (XSS) vulnerability in the getWindowOpenJavaScript function in org.apache.wicket.extensions.ajax.ma
CVE-2016-6793 CRITICAL
9.1 Jul 17

The DiskFileItem class in Apache Wicket 6.x before 6.25.0 and 1.5.x before 1.5.17 allows remote attackers to cause a den
CVE-2024-36522 CRITICAL
9.8 Jul 12

The default configuration of XSLTResourceStream.java is vulnerable to remote code execution via XSLT injection when proc
CVE-2016-6806 HIGH
8.8 Oct 03

Apache Wicket 6.x before 6.25.0, 7.x before 7.5.0, and 8.0.0-M1 provide a CSRF prevention measure that fails to discover
CVE-2014-3526 HIGH
7.5 Oct 30

Apache Wicket before 1.5.12, 6.x before 6.17.0, and 7.x before 7.0.0-M3 might allow remote attackers to obtain sensitive
CVE-2014-7808 HIGH
7.5 Sep 15

Apache Wicket before 1.5.13, 6.x before 6.19.0, and 7.x before 7.0.0-M5 make it easier for attackers to defeat a cryptog
CVE-2026-71257 HIGH
7.5 Aug 30

Per-file size and file-count upload limit enforcement in Apache Wicket 8.x through 10.x can be bypassed when a co-deploy
CVE-2021-23937 HIGH
7.5 May 25

A DNS proxy and possible amplification attack vulnerability in WebClientInfo of Apache Wicket allows an attacker to trig
CVE-2020-11976 HIGH
7.5 Aug 11

By crafting a special URL it is possible to make Wicket deliver unprocessed HTML templates. Rated high severity (CVSS 7.
CVE-2024-27439 MEDIUM
6.5 Mar 19

An error in the evaluation of the fetch metadata headers could allow a bypass of the CSRF protection in Apache Wicket.1.
CVE-2012-5636 MEDIUM
6.1 Oct 30

Cross-site scripting (XSS) vulnerability in Apache Wicket 1.4.x before 1.4.22, 1.5.x before 1.5.10, and 6.x before 6.4.0
CVE-2015-7520 MEDIUM
6.1 Apr 12

Multiple cross-site scripting (XSS) vulnerabilities in the (1) RadioGroup and (2) CheckBoxMultipleChoice classes in Apac

Same weakness CWE-79 – Cross-site Scripting (XSS)

View all
CVE-2020-3580 MEDIUM POC
6.1
CVE-2013-7389 MEDIUM POC
4.3
CVE-2021-25299 MEDIUM POC
6.1
CVE-2014-2120 MEDIUM
6.1
CVE-2023-40000 HIGH POC
8.3
CVE-2016-8581 MEDIUM POC
6.1
CVE-2013-5223 MEDIUM POC
5.4
CVE-2025-52367 MEDIUM POC
5.4

Same technique XSS

View all
CVE-2017-9248 CRITICAL POC
9.8
CVE-2020-3580 MEDIUM POC
6.1
CVE-2013-1710 CRITICAL POC
10.0
CVE-2013-7389 MEDIUM POC
4.3
CVE-2021-25299 MEDIUM POC
6.1
CVE-2014-2120 MEDIUM
6.1
CVE-2023-40000 HIGH POC
8.3
CVE-2024-52875 HIGH POC
8.8

Share

CVE-2026-76984 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy