Apache Wicket EUVD-2026-114901

The affected application must bind org.apache.wicket.markup.html.link.ExternalLink to a markup tag that is NOT an a, link, or area element (for example a button or span), which causes Wicket to build a JavaScript onclick handler, AND the URL in the component's model must hold data an attacker can influence (the vendor describes this as the component's ordinary use). The second affected path requires PopupSettings to be attached, placing the value into the generated window.open() call. Exploitation is unauthenticated (PR:N) and remote (AV:N) but is gated by required victim interaction - nothing executes until a user activates the element (UI:A) - and by the deployment-specific component binding (AT:P), which together are the main real-world limiting factors. Only Wicket 8.0.0 through 8.19.0 are affected; 7.x and older are end-of-life.

This is a genuine but conditional stored/reflected XSS (CWE-79) in Apache Wicket, scored CVSS 4.0 7.4 by the Apache reporter. The 4.0 vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A reflects a network-reachable, unauthenticated (PR:N) flaw that nevertheless requires two things the attacker does not directly control: a specific application coding pattern (the AT:P attack requirement) and a victim actively activating the element (UI:A). Exploitation status is 'no public exploit identified at time of analysis' - there is no KEV listing, no POC reference, and no EPSS value supplied, so the only exploitation signal is the vendor-assigned priority of 'this_week', which indicates it should be addressed promptly but is not flagged as an emergency or as actively exploited. The high VC:H/VI:H impact is the main driver of the 7.4: successful exploitation runs arbitrary script in the application's origin, enabling session/credential theft and unauthorized actions as the victim. The practical risk is tempered by the AT:P condition - the application must bind an ExternalLink to a non-anchor tag (button/span) whose model URL carries attacker-influenced data - and by the UI requirement. Key missing data to note explicitly: EPSS is absent (exploitation probability cannot be quantified), and no POC/KEV data narrows the picture, so prioritization should rest on the vendor 'this_week' label plus the concrete affected-version range rather than on confirmed in-the-wild activity.

An application uses Wicket's ExternalLink bound to a span or button (not an anchor) with a URL drawn from user-controllable data, such as a profile website field. An attacker stores a value containing an apostrophe that closes the generated single-quoted JavaScript string literal and appends script; when any user clicks the rendered element, the payload executes in the application's origin. No public exploit code has been identified, and exploitation requires that specific component-to-non-anchor binding plus a victim click.