CVE-2026-75802

AjaxEditableChoiceLabel in wicket-extensions, when constructed with a non-null IChoiceRenderer, writes the display value obtained from that renderer into the label's markup without applying the HTML escaping Wicket performs by default for component model values. An attacker who can influence the choice or model data rendered by such a label can inject HTML or script that executes in the browser of any user who views the page. The same value is correctly escaped when the component's dropdown editor renders it as an option, so only the label rendering is affected. AjaxEditableLabel, AjaxEditableChoiceLabel and AjaxEditableMultiLineLabel write the value returned by the protected defaultNullLabel() method into the label's markup the same way when the component's model is empty, while the model value they show otherwise is escaped. The default implementation returns a constant, so an application is affected where it overrides that method and returns a value an attacker can influence. Neither value could be escaped by configuration, because escapeModelStrings had no effect on any of the three components: it is read by the label they render with rather than by the component itself, and nothing carried the setting across. This issue affects Apache Wicket: from 8.0.0 through 8.18.0, from 9.0.0 through 9.23.0, from 10.0.0 through 10.10.0. Older, unsupported releases are also affected; the display value from the renderer since 6.22.0 and the null label since 1.4.0. Users are recommended to upgrade to version 8.19.0, 9.24.0 or 10.11.0, which fix the issue.

• CWE-79

• https://lists.apache.org/thread/lrmo7mddb4v4ffl36g5b9x8s40tbmw68Vendor Advisory, Mailing List
• https://www.openwall.com/lists/oss-security/2026/08/31/1Mailing List, Third Party Advisory

Published

Aug 31, 2026

Last Modified

Sep 1, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-75793The SureCart WordPress plugin before 4.7.0 does not consult…6.5
• CVE-2026-75796The AI Engine WordPress plugin before 3.6.1 does not verify…7.2
• CVE-2026-75797The AI Engine WordPress plugin before 3.7.2 does not confin…7.7
• CVE-2026-75798The AI Engine WordPress plugin before 3.7.2 does not perfor…5.3
• CVE-2026-7580A vulnerability was detected in Exiftool up to 13.53. Impact…5.3
• CVE-2026-75800The Frontegg SAML SSO WordPress plugin through 1.0.1 does no…9.8
• CVE-2026-75803Issue summary: ChaCha20-Poly1305 and AES-OCB decryption with…9.1
• CVE-2026-75807The SAML Single Sign On – SSO Login plugin for WordPress is …7.5
• CVE-2026-75808Allocation of Resources Without Limits or Throttling in ASUS…5.7
• CVE-2026-75809Exposed IOCTL with insufficient access control in ASUS Armou…5.9
• CVE-2026-7581A security vulnerability has been detected in alexta69 MeTub…4.3
• CVE-2026-75810Exposed Dangerous Method or Function in ASUS Armoury Crate a…5.7