Apache Wicket EUVD-2026-114895

The application must render attacker-influenced text through org.apache.wicket.extensions.markup.html.basic.SmartLinkLabel or SmartLinkMultiLineLabel (no other component uses DefaultLinkParser); an application using neither is not affected. Exploitation further requires that a reader actively click the injected link (UI:A) - rendering the page alone does not trigger it. The principal limiting factor is Content-Security-Policy: on 9.x and 10.x the default nonce-based CSP prevents the injected script from running, so only deployments that have weakened or disabled CSP are exploitable on those branches; Wicket 8.x has no CSP support and is affected as it stands. No authentication is required of the attacker (PR:N). Remediation is upgrade to 8.20.0, 9.25.0, or 10.12.0.

The input provides a CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N, base 7.4) indicating a network, unauthenticated vector that nonetheless carries a genuine attack requirement (AT:P) and requires active user interaction (UI:A) - the victim must click the linkified payload, so this is not a drive-by. No EPSS score and no KEV status are present in the input, so exploitation probability cannot be quantified from the data supplied; there is no public exploit identified at time of analysis - the sole reference is the Apache advisory. Several signals lower real-world urgency below what the 7.4 suggests: exploitation requires that the application actually render untrusted text through SmartLinkLabel or SmartLinkMultiLineLabel, requires a victim click, and on the 9.x and 10.x branches the default Content-Security-Policy (nonce-based) blocks the injected script entirely unless the operator has weakened or disabled CSP. The 8.x branch has no CSP support and is exposed in full. The vuln.today decision label is 'this_week', which aligns with a real-but-conditional XSS rather than an emergency: it is a legitimate priority for the subset of deployments using these components (especially 8.x or any branch with a relaxed CSP), but not a mass-exploitation threat given the user-click requirement and the default-CSP mitigation on supported branches.

An attacker places text containing a script-executing scheme (e.g. a javascript: URL) into data the application later displays through SmartLinkLabel or SmartLinkMultiLineLabel; DefaultLinkParser wraps the matched scheme://rest text in an anchor whose href is copied in verbatim. When a victim viewing the page clicks that link, the script runs in the application's origin and the victim's own authenticated session. No public exploit is identified at time of analysis; only the Apache advisory is referenced, and execution is blocked on 9.x/10.x unless the default CSP has been weakened.