CVE-2026-66390

CVE-2026-66390: Apache Wicket: crafted Link URL strings can break out of the JavaScript sequence

Vendor Apache Software Foundation
Product Apache Wicket
Weakness CWE-79 · XSS
Published July 27, 2026
Last update July 28, 2026
View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Wicket. This issue affects Apache Wicket: from 9.0.0 through 9.23.0, from 10.0.0 through 10.9.0. Users are recommended to upgrade to version 10.10.0, which fixes the issue.

Key dates

02Disclosure timeline

July 27, 2026 CVE published
July 28, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2026-73344 WordPress WP Data Access plugin <= 5.5.79 - Cross Site Scripting (XSS) vulnerability CVE-2026-2357 Bold Page Builder <= 5.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2026-18328 Forminator Forms <= 1.57.0 - Unauthenticated DOM-Based Cross-Site Scripting via 'error_description' Parameter CVE-2026-15948 Hydra Booking <= 1.2.2 - Authenticated (Host+) Stored Cross-Site Scripting via 'first_name' Parameter CVE-2026-66646 WordPress WP Tab Widget plugin <= 1.2.11 - Cross Site Scripting (XSS) vulnerability