Cross-site scripting in Apache wicket-jquery-ui
Priority LOW 29CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-79.
Summary
In Apache wicket-jquery-ui <= 6.29.0, <= 7.10.1, <= 8.0.0-M9.1, JS code created in WYSIWYG editor will be executed on display.
Why it matters now
EPSS 0.00811 57th percentileScored 2026-11-07
Fix Fixed com.googlecode.wicket-jquery-ui:wicket-jquery-ui-parent (Maven): 6.29.1, 7.10.2, 8.0.0-M9.2
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apache | wicket-jquery-ui | wicket-jquery-ui <= 6.29.0, <= 7.10.1, <= 8.0.0-M9.1 | — | No fix listed | CNA |
| — | com.googlecode.wicket-jquery-ui:wicket-jquery-ui-parent (Maven) | before 6.29.1 | 6.29.1 | Patch available | GHSA-pjv3-rh6v-2pj8 |
| — | com.googlecode.wicket-jquery-ui:wicket-jquery-ui-parent (Maven) | 7.0.0 to before 7.10.2 | 7.10.2 | Patch available | GHSA-pjv3-rh6v-2pj8 |
| — | com.googlecode.wicket-jquery-ui:wicket-jquery-ui-parent (Maven) | 8.0.0-M1 to before 8.0.0-M9.2 | 8.0.0-M9.2 | Patch available | GHSA-pjv3-rh6v-2pj8 |
- wicket-jquery-ui VendorApache Affected wicket-jquery-ui <= 6.29.0, <= 7.10.1, <= 8.0.0-M9.1 Fixed in — No fix listed CNA
- com.googlecode.wicket-jquery-ui:wicket-jquery-ui-parent (Maven) Vendor— Affected before 6.29.1 Fixed in 6.29.1 Patch available GHSA-pjv3-rh6v-2pj8
- com.googlecode.wicket-jquery-ui:wicket-jquery-ui-parent (Maven) Vendor— Affected 7.0.0 to before 7.10.2 Fixed in 7.10.2 Patch available GHSA-pjv3-rh6v-2pj8
- com.googlecode.wicket-jquery-ui:wicket-jquery-ui-parent (Maven) Vendor— Affected 8.0.0-M1 to before 8.0.0-M9.2 Fixed in 8.0.0-M9.2 Patch available GHSA-pjv3-rh6v-2pj8
CPE configurations NVD · 20
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:*:*:*:*:*:*:*:* | 6.0.0 – 6.29.0; 7.0.1 – 7.10.1 | Vulnerable | Wicket-jquery-ui Project |
| cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:7.0.0:-:*:*:*:*:*:* | 7.0.0 | Vulnerable | Wicket-jquery-ui Project |
| cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:7.0.0:milestone3:*:*:*:*:*:* | 7.0.0 milestone3 | Vulnerable | Wicket-jquery-ui Project |
| cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:7.0.0:milestone4:*:*:*:*:*:* | 7.0.0 milestone4 | Vulnerable | Wicket-jquery-ui Project |
| cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:7.0.0:milestone5:*:*:*:*:*:* | 7.0.0 milestone5 | Vulnerable | Wicket-jquery-ui Project |
| cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:7.0.0:milestone6:*:*:*:*:*:* | 7.0.0 milestone6 | Vulnerable | Wicket-jquery-ui Project |
| cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:8.0.0:-:*:*:*:*:*:* | 8.0.0 | Vulnerable | Wicket-jquery-ui Project |
| cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:8.0.0:milestone1:*:*:*:*:*:* | 8.0.0 milestone1 | Vulnerable | Wicket-jquery-ui Project |
| cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:8.0.0:milestone1.1:*:*:*:*:*:* | 8.0.0 milestone1.1 | Vulnerable | Wicket-jquery-ui Project |
| cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:8.0.0:milestone2:*:*:*:*:*:* | 8.0.0 milestone2 | Vulnerable | Wicket-jquery-ui Project |
- cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:*:*:*:*:*:*:*:* Versions 6.0.0 – 6.29.0; 7.0.1 – 7.10.1 Vulnerable ·Wicket-jquery-ui Project
- cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:7.0.0:-:*:*:*:*:*:* Versions 7.0.0 Vulnerable ·Wicket-jquery-ui Project
- cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:7.0.0:milestone3:*:*:*:*:*:* Versions 7.0.0 milestone3 Vulnerable ·Wicket-jquery-ui Project
- cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:7.0.0:milestone4:*:*:*:*:*:* Versions 7.0.0 milestone4 Vulnerable ·Wicket-jquery-ui Project
- cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:7.0.0:milestone5:*:*:*:*:*:* Versions 7.0.0 milestone5 Vulnerable ·Wicket-jquery-ui Project
- cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:7.0.0:milestone6:*:*:*:*:*:* Versions 7.0.0 milestone6 Vulnerable ·Wicket-jquery-ui Project
- cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:8.0.0:-:*:*:*:*:*:* Versions 8.0.0 Vulnerable ·Wicket-jquery-ui Project
- cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:8.0.0:milestone1:*:*:*:*:*:* Versions 8.0.0 milestone1 Vulnerable ·Wicket-jquery-ui Project
- cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:8.0.0:milestone1.1:*:*:*:*:*:* Versions 8.0.0 milestone1.1 Vulnerable ·Wicket-jquery-ui Project
- cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:8.0.0:milestone2:*:*:*:*:*:* Versions 8.0.0 milestone2 Vulnerable ·Wicket-jquery-ui Project
Show 10 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:8.0.0:milestone3:*:*:*:*:*:* | 8.0.0 milestone3 | Vulnerable | Wicket-jquery-ui Project |
| cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:8.0.0:milestone4:*:*:*:*:*:* | 8.0.0 milestone4 | Vulnerable | Wicket-jquery-ui Project |
| cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:8.0.0:milestone4.1:*:*:*:*:*:* | 8.0.0 milestone4.1 | Vulnerable | Wicket-jquery-ui Project |
| cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:8.0.0:milestone5:*:*:*:*:*:* | 8.0.0 milestone5 | Vulnerable | Wicket-jquery-ui Project |
| cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:8.0.0:milestone6:*:*:*:*:*:* | 8.0.0 milestone6 | Vulnerable | Wicket-jquery-ui Project |
| cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:8.0.0:milestone7:*:*:*:*:*:* | 8.0.0 milestone7 | Vulnerable | Wicket-jquery-ui Project |
| cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:8.0.0:milestone8:*:*:*:*:*:* | 8.0.0 milestone8 | Vulnerable | Wicket-jquery-ui Project |
| cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:8.0.0:milestone8.1:*:*:*:*:*:* | 8.0.0 milestone8.1 | Vulnerable | Wicket-jquery-ui Project |
| cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:8.0.0:milestone9:*:*:*:*:*:* | 8.0.0 milestone9 | Vulnerable | Wicket-jquery-ui Project |
| cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:8.0.0:milestone9.1:*:*:*:*:*:* | 8.0.0 milestone9.1 | Vulnerable | Wicket-jquery-ui Project |
- cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:8.0.0:milestone3:*:*:*:*:*:* Versions 8.0.0 milestone3 Vulnerable ·Wicket-jquery-ui Project
- cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:8.0.0:milestone4:*:*:*:*:*:* Versions 8.0.0 milestone4 Vulnerable ·Wicket-jquery-ui Project
- cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:8.0.0:milestone4.1:*:*:*:*:*:* Versions 8.0.0 milestone4.1 Vulnerable ·Wicket-jquery-ui Project
- cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:8.0.0:milestone5:*:*:*:*:*:* Versions 8.0.0 milestone5 Vulnerable ·Wicket-jquery-ui Project
- cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:8.0.0:milestone6:*:*:*:*:*:* Versions 8.0.0 milestone6 Vulnerable ·Wicket-jquery-ui Project
- cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:8.0.0:milestone7:*:*:*:*:*:* Versions 8.0.0 milestone7 Vulnerable ·Wicket-jquery-ui Project
- cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:8.0.0:milestone8:*:*:*:*:*:* Versions 8.0.0 milestone8 Vulnerable ·Wicket-jquery-ui Project
- cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:8.0.0:milestone8.1:*:*:*:*:*:* Versions 8.0.0 milestone8.1 Vulnerable ·Wicket-jquery-ui Project
- cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:8.0.0:milestone9:*:*:*:*:*:* Versions 8.0.0 milestone9 Vulnerable ·Wicket-jquery-ui Project
- cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:8.0.0:milestone9.1:*:*:*:*:*:* Versions 8.0.0 milestone9.1 Vulnerable ·Wicket-jquery-ui Project
Remediation
- Fix · GHSA-pjv3-rh6v-2pj8 com.googlecode.wicket-jquery-ui:wicket-jquery-ui-parent (Maven) Fixed in 6.29.1 Advisory →
- Fix · GHSA-pjv3-rh6v-2pj8 com.googlecode.wicket-jquery-ui:wicket-jquery-ui-parent (Maven) Fixed in 7.10.2 Advisory →
- Fix · GHSA-pjv3-rh6v-2pj8 com.googlecode.wicket-jquery-ui:wicket-jquery-ui-parent (Maven) Fixed in 8.0.0-M9.2 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2018-1325
- 2026-10-03 Alias added: GHSA-pjv3-rh6v-2pj8
References
More Apache vulnerabilities
- TI-2025-18529 Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT KEVCVSS 3.1CRITICAL 10.0
- TI-2024-30292 Apache OFBiz: Confused controller-view authorization logic (forced browsing) KEVCVSS 3.1CRITICAL 9.8
- TI-2024-26062 Apache OFBiz: Unauthenticated endpoint could allow execution of screen rendering code KEVCVSS 3.1CRITICAL 9.8
- TI-2024-21190 Apache OFBiz: Path traversal leading to RCE KEVCVSS 3.1CRITICAL 9.8
- TI-2024-18186 Apache HugeGraph-Server: Command execution in gremlin KEVCVSS 3.1CRITICAL 9.8
- TI-2023-25106 Deserialization of untrusted data in Apache ActiveMQ KEVCVSS 3.1CRITICAL 10.0
Sources
- CVE-2018-1325 · CVE Program
- CVE-2018-1325 · NVD
- FIRST EPSS
- GHSA-pjv3-rh6v-2pj8 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences