The vulnerability is an improper neutralization of user input during web page generation. It allows attackers to inject crafted strings that break out of a JavaScript context, enabling the execution of arbitrary JavaScript within a victim’s browser. This can lead to session hijacking, credential theft, or defacement of the application. The weakness corresponds to CWE‑79, where input is not correctly sanitized before incorporation into a web page.

Apache Software Foundation’s Apache Wicket web framework is affected in all released versions from 8.0.0 through 8.17.0, the single 9.0.0 release, and from 10.0.0 through 10.8.0. Users operating any of these versions should be aware of the risk.

There is a CVSS score of 6.1 indicating moderate severity, and the EPSS score is <1%, which suggests a low likelihood of exploitation. The flaw is broadly exploitable via normal web requests and does not require elevated privileges. It is not listed in the CISA KEV catalog. The likely attack vector is embedding malicious payloads within URLs or input fields that are rendered into JavaScript contexts, such as query parameters or form submissions. Based on the description, it is inferred that the vulnerability can be triggered when arbitrary strings are injected in the page generation phase, resulting in client‑side script execution.