The vulnerability arises because the Button component in Apache Wicket clears the escape flag for model strings in its constructor. When the component renders as a <button> element, it writes the model object into the element body, where no encoding occurs, resulting in raw markup being delivered to the browser. This flaw allows an attacker to inject arbitrary HTML or JavaScript into the page through a controlled model value, leading to a classic cross‑site scripting scenario.

Apache Wicket versions 8.0.0 through 8.18.0, 9.0.0 through 9.23.0, and 10.0.0 through 10.10.0 are affected. Older unsupported releases from 6.25.0 onward are also vulnerable. The flaw applies to Button and its subclasses AjaxButton, AjaxFallbackButton, and WizardButton when rendered as a <button> element.

The CVSS score of 5.1 indicates moderate severity, and the EPSS score is currently unavailable. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the most likely attack vector is an attacker who can influence the button's model object – either through user input or stored data – delivering malicious content into the page body. This can compromise the integrity of the web application and provide attackers with the ability to execute scripts in the context of the victim’s browser. Because an application may be unaware of the source of the model data, prevention requires both code-level safeguards and an update to the library.