https://seclists.org/oss-sec/2026/q3/619: CVE-2026-76982: Apache Wicket: XSS in Button via its model object
Published Aug 31, 2026
·Updated
Affected Software
5 affected components
Apache wicket>=8.0.0<=8.18.0
Apache wicket>=9.0.0<=9.23.0
Apache wicket>=10.0.0<=10.10.0
Apache wicket>=6.25.0
Apache wicket>=7.5.0
Frequently Asked Questions
1
Which application uses are exposed to this issue?
An application is affected when it renders a Wicket Button on a <button> element and the button model contains data that an attacker can influence. The affected Wicket core version ranges are 8.0.0 through 8.18.0, 9.0.0 through 9.23.0, and 10.0.0 through 10.10.0.
2
Does the attacker need to supply the malicious value directly in a request?
No. The model value may originate from a request or from stored data; Wicket cannot determine the value's source. Exploitability depends on whether the application allows an attacker to influence data placed in the Button model.
3
How can I determine whether my application is affected?
Review Button usage and templates to identify components attached to <button> rather than <input> elements. For each such component, trace its model object to determine whether attacker-controlled data can reach it.