This vulnerability is an improper neutralization of user supplied data during rendering of web page headers in Apache Wicket. The framework escapes attribute names but incorrectly replaces double quotation marks (") in attribute values with an escaped form that is treated as a literal backslash in HTML. An attribute value containing a double quote thereby terminates the current attribute and injects a new, malicious attribute. An attacker can exploit this flaw to inject arbitrary HTML or JavaScript into a page, resulting in a cross‑site scripting condition. The weakness corresponds to CWE‑79, a classic injection flaw.

The flaw affects Apache Wicket versions 8.0.0 through 8.18.0, 9.0.0 through 9.23.0, 10.0.0 through 10.10.0, and older unsupported releases from 6.17.0 onward. The Apache Software Foundation is the vendor, and the product is Apache Wicket. Users of any of these affected releases are at risk if applications supply values to the MetaDataHeaderItem component via addTagAttribute or the provided factory methods.

The CVSS v3 score is 5.1, indicating a medium severity that may allow an attacker to compromise confidentiality and integrity of user data via stored or reflected XSS. EPSS information is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no currently known widespread exploitation in the wild. The likely attack vector is a remote attacker supplying malicious input to the application, either directly through user form fields or indirectly via malicious URLs, which is then forwarded to Wicket’s header component. An attacker would need the application to call addTagAttribute or the related factory methods with a user‑controlled value containing double quotes.