The vulnerability is an improper neutralization of user input during web page generation, allowing an attacker to inject crafted strings that break out of a JavaScript context. This cross‑site scripting flaw can enable attackers to inject and execute arbitrary JavaScript in the context of legitimate users, potentially leading to session hijacking, credential theft, or defacement of the application. The weakness is a classic example of CWE‑79, where input is not correctly sanitized before being rendered into a web page.

Apache Software Foundation's Apache Wicket web framework is affected in all released versions from 8.0.0 through 8.17.0, the single 9.0.0 release, and from 10.0.0 through 10.8.0. Users running any of these versions should be aware of the risk.

There is no public CVSS score available and the EPSS score is not provided, but the flaw is broadly exploitable via normal web requests and does not require elevated privileges. It is not listed in the CISA KEV catalog. Attackers can leverage the vulnerability by crafting malicious input that is rendered within JavaScript, typically through URLs or input fields, to cause arbitrary script execution in the user’s browser.