AjaxEditableChoiceLabel in wicket‑extensions writes the display value obtained from an IChoiceRenderer directly into the component label without applying the HTML escaping that Wicket normally performs. As a result, an attacker who can influence the choice or model data can inject malicious HTML or script that executes in the browsers of any user who views the affected page. This is a stored or reflected client‑side XSS vulnerability that could enable the attacker to perform actions in a victim’s session, steal data, or otherwise compromise the user experience. The weakness is a failure to escape untrusted content and is classified as CWE‑79.

The vendor is the Apache Software Foundation, product Apache Wicket. Affected versions are 8.0.0 through 8.18.0, 9.0.0 through 9.23.0, and 10.0.0 through 10.10.0. Earlier releases such as 6.22.0 and 1.4.0 also contain the vulnerable logic. The vendor recommends upgrading to 8.19.0, 9.24.0, or 10.11.0 to remediate the issue.

The CVSS base score is 5.1, indicating moderate severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog, suggesting that widespread exploitation has not yet been documented. However, because the flaw is triggered by user‑controllable data passed to AjaxEditableLabel components, the attack vector is likely remote. The lack of configuration overrides means that the flaw cannot be mitigated by disabling escaping; only application updates or data sanitization can prevent exploitation.