What’s Vulnerable › Vulnerabilities

CVE-2017-15719

• Severity: medium (CVSS 6.1 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.9% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2018-03-12 · updated 2026-06-17
• Weakness: CWE-79

Description

In Wicket jQuery UI 6.28.0 and earlier, 7.9.1 and earlier, and 8.0.0-M8 and earlier, a security issue has been discovered in the WYSIWYG editor that allows an attacker to submit arbitrary JS code to WYSIWYG editor.

Affected products

• Apache Software Foundation Wicket jQuery UI: from 6.0.0 through 6.28.0; through 7.9.1; 7.0.0, 7.0.0-milestone3, 7.0.0-milestone4, 7.0.0-milestone5, 7.0.0-milestone6, 7.0.1 (+24)

References

• http://openmeetings.apache.org/security.html#_toc_cve-2017-15719_-_wicket_jquery_ui_xss_in_wysiwyg_e
• https://github.com/sebfz1/wicket-jquery-ui/wiki#cve-2017-15719---xss-in-wysiwyg-editor
• http://openmeetings.apache.org/security.html#_toc_cve-2017-15719_-_wicket_jquery_ui_xss_in_wysiwyg_e
• https://github.com/sebfz1/wicket-jquery-ui/wiki#cve-2017-15719---xss-in-wysiwyg-editor

Get alerted when CVE-2017-15719 or the next vulnerability affects your stack