This vulnerability is an XSS flaw in Apache Wicket's AbstractSingleSelectChoice component. The component writes the body of the default option directly into the page without sanitization, while all other options are escaped according to the escape-model-strings configuration. When an application overrides getNullValidDisplayValue() or getNullKeyDisplayValue() to return attacker-controlled data, or supplies a null bundle entry containing malicious content, the unescaped value becomes part of the rendered markup. As a result, an attacker can inject arbitrary script into the page, potentially hijacking user sessions, stealing cookies, or defacing the site. The weakness is catalogued as CWE‑79.

Apache Wicket versions 8.0.0 through 8.18.0, 9.0.0 through 9.23.0, and 10.0.0 through 10.10.0 are vulnerable. Additional older releases starting from 1.5.0 are also affected. The flaw is triggered only in applications that customize the null display value or define a null bundle entry with user-controllable data. Built-in components such as RadioChoice are not affected.

The vulnerability is a classic client‑side XSS that can be exploited by a malicious actor who can influence the default option value, for example through custom code or a crafted resource bundle. While no EPSS score is available and the vulnerability is not listed in the CISA KEV catalog, the potential impact of injecting malicious scripts into a user’s browser session is significant. The attacker does not need special privileges beyond the ability to modify the application’s code or resource files, making the exploit path straightforward for an attacker who has access to these components.