Medium
Security advisory
In Wicket jQuery UI 6.28.0 and earlier, 7.9.1 and earlier, and 8.0.0-M8 and earlier, a security issue has been discovered in the WYSIWYG editor that allows an attacker to submit arbitrary JS code to WYSIWYG editor.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2017-15719
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 05:11 UTC · Revision 1
Source evidence
In Wicket jQuery UI 6.28.0 and earlier, 7.9.1 and earlier, and 8.0.0-M8 and earlier, a security issue has been discovered in the WYSIWYG editor that allows an attacker to submit arbitrary JS code to WYSIWYG editor.
osv:CVE-2017-15719
Complete source record
{
"id": "329e87ded701fdca57d2524f072eb948dd2008d7c6abdc7f7baff0610cc19dbf",
"url": "https://osv.dev/vulnerability/CVE-2017-15719",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2017-15719",
"summary": "In Wicket jQuery UI 6.28.0 and earlier, 7.9.1 and earlier, and 8.0.0-M8 and earlier, a security issue has been discovered in the WYSIWYG editor that allows an attacker to submit arbitrary JS code to WYSIWYG editor.",
"evidence": "osv:CVE-2017-15719",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2017-15719",
"aliases": [
"CVE-2017-15719",
"GHSA-pwpc-hqq2-hx2x"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/sebfz1/wicket-jquery-ui",
"type": "GIT",
"events": [
{
"introduced": "dcb51ab95a979c336ce9db02c6df499fe8fb1b4f"
},
{
"last_affected": "d007deedccfc44d764c15e8fe5a21a0f117bd51e"
},
{
"introduced": "0"
},
{
"last_affected": "60d133c01f41b4e6911301781f96cd8dd53e0d15"
},
{
"introduced": "be7daa360d40c5f32f78a36ef056ab28e953d4d6"
},
{
"last_affected": "261bda97e77bbc23b06574969509bf53b62ef265"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "6.0.0"
},
{
"last_affected": "6.28.0"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"last_affected": "7.9.1"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:7.0.0:-:*:*:*:*:*:*",
"range": [
{
"introduced": "7.0.0-NA"
},
{
"last_affected": "7.0.0-NA"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:7.0.0:milestone3:*:*:*:*:*:*",
"range": [
{
"introduced": "7.0.0-milestone3"
},
{
"last_affected": "7.0.0-milestone3"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:7.0.0:milestone4:*:*:*:*:*:*",
"range": [
{
"introduced": "7.0.0-milestone4"
},
{
"last_affected": "7.0.0-milestone4"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:7.0.0:milestone5:*:*:*:*:*:*",
"range": [
{
"introduced": "7.0.0-milestone5"
},
{
"last_affected": "7.0.0-milestone5"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:7.0.0:milestone6:*:*:*:*:*:*",
"range": [
{
"introduced": "7.0.0-milestone6"
},
{
"last_affected": "7.0.0-milestone6"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:7.0.1:*:*:*:*:*:*:*",
"range": [
{
"introduced": "7.0.1"
},
{
"last_affected": "7.0.1"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:7.0.2:*:*:*:*:*:*:*",
"range": [
{
"introduced": "7.0.2"
},
{
"last_affected": "7.0.2"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:7.1.0:*:*:*:*:*:*:*",
"range": [
{
"introduced": "7.1.0"
},
{
"last_affected": "7.1.0"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:7.2.0:*:*:*:*:*:*:*",
"range": [
{
"introduced": "7.2.0"
},
{
"last_affected": "7.2.0"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:7.2.1:*:*:*:*:*:*:*",
"range": [
{
"introduced": "7.2.1"
},
{
"last_affected": "7.2.1"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:7.3.0:*:*:*:*:*:*:*",
"range": [
{
"introduced": "7.3.0"
},
{
"last_affected": "7.3.0"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:7.3.1:*:*:*:*:*:*:*",
"range": [
{
"introduced": "7.3.1"
},
{
"last_affected": "7.3.1"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:7.4.0:*:*:*:*:*:*:*",
"range": [
{
"introduced": "7.4.0"
},
{
"last_affected": "7.4.0"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:7.5.0:*:*:*:*:*:*:*",
"range": [
{
"introduced": "7.5.0"
},
{
"last_affected": "7.5.0"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:7.6.0:*:*:*:*:*:*:*",
"range": [
{
"introduced": "7.6.0"
},
{
"last_affected": "7.6.0"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:7.7.0:*:*:*:*:*:*:*",
"range": [
{
"introduced": "7.7.0"
},
{
"last_affected": "7.7.0"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:7.8.0:*:*:*:*:*:*:*",
"range": [
{
"introduced": "7.8.0"
},
{
"last_affected": "7.8.0"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:7.9.0:*:*:*:*:*:*:*",
"range": [
{
"introduced": "7.9.0"
},
{
"last_affected": "7.9.0"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:7.9.1:*:*:*:*:*:*:*",
"range": [
{
"introduced": "7.9.1"
},
{
"last_affected": "7.9.1"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:8.0.0:-:*:*:*:*:*:*",
"range": [
{
"introduced": "8.0.0-NA"
},
{
"last_affected": "8.0.0-NA"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:8.0.0:milestone1:*:*:*:*:*:*",
"range": [
{
"introduced": "8.0.0-milestone1"
},
{
"last_affected": "8.0.0-milestone1"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:8.0.0:milestone1.1:*:*:*:*:*:*",
"range": [
{
"introduced": "8.0.0-milestone1\\.1"
},
{
"last_affected": "8.0.0-milestone1\\.1"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:8.0.0:milestone2:*:*:*:*:*:*",
"range": [
{
"introduced": "8.0.0-milestone2"
},
{
"last_affected": "8.0.0-milestone2"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:8.0.0:milestone3:*:*:*:*:*:*",
"range": [
{
"introduced": "8.0.0-milestone3"
},
{
"last_affected": "8.0.0-milestone3"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:8.0.0:milestone4:*:*:*:*:*:*",
"range": [
{
"introduced": "8.0.0-milestone4"
},
{
"last_affected": "8.0.0-milestone4"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:8.0.0:milestone4.1:*:*:*:*:*:*",
"range": [
{
"introduced": "8.0.0-milestone4\\.1"
},
{
"last_affected": "8.0.0-milestone4\\.1"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:8.0.0:milestone5:*:*:*:*:*:*",
"range": [
{
"introduced": "8.0.0-milestone5"
},
{
"last_affected": "8.0.0-milestone5"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:8.0.0:milestone6:*:*:*:*:*:*",
"range": [
{
"introduced": "8.0.0-milestone6"
},
{
"last_affected": "8.0.0-milestone6"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:8.0.0:milestone7:*:*:*:*:*:*",
"range": [
{
"introduced": "8.0.0-milestone7"
},
{
"last_affected": "8.0.0-milestone7"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:wicket-jquery-ui_project:wicket-jquery-ui:8.0.0:milestone8:*:*:*:*:*:*",
"range": [
{
"introduced": "8.0.0-milestone8"
},
{
"last_affected": "8.0.0-milestone8"
}
],
"source": "CPE_STRING"
}
]
}
}
],
"versions": [
"7.0.0-NA",
"7.0.0-milestone3",
"7.0.0-milestone4",
"7.0.0-milestone5",
"7.0.0-milestone6",
"7.0.1",
"7.0.2",
"7.1.0",
"7.2.0",
"7.2.1",
"7.3.0",
"7.3.1",
"7.4.0",
"7.5.0",
"7.6.0",
"7.7.0",
"7.8.0",
"7.9.0",
"7.9.1",
"8.0.0-NA",
"8.0.0-milestone1",
"8.0.0-milestone1\\.1",
"8.0.0-milestone2",
"8.0.0-milestone3",
"8.0.0-milestone4",
"8.0.0-milestone4\\.1",
"8.0.0-milestone5",
"8.0.0-milestone6",
"8.0.0-milestone7",
"8.0.0-milestone8",
"wicket-jquery-ui-parent-7.9.1",
"wicket-jquery-ui-8.0.0-M8",
"wicket-jquery-ui-6.28.0",
"wicket-jquery-ui-7.9.0",
"wicket-jquery-ui-8.0.0-M7",
"wicket-jquery-ui-7.8.0",
"wicket-jquery-ui-6.27.0",
"wicket-jquery-ui-7.7.0",
"wicket-jquery-ui-8.0.0-M6",
"wicket-jquery-ui-8.0.0-M5",
"wicket-jquery-ui-8.0.0-M4.1",
"wicket-jquery-ui-8.0.0-M4",
"wicket-jquery-ui-6.26.0",
"wicket-jquery-ui-7.6.0",
"wicket-jquery-ui-8.0.0-M3",
"wicket-jquery-ui-6.25.0",
"wicket-jquery-ui-7.5.0",
"wicket-jquery-ui-8.0.0-M2",
"wicket-jquery-ui-8.0.0-M1.1",
"wicket-jquery-ui-7.4.0",
"wicket-jquery-ui-6.24.0",
"wicket-jquery-ui-8.0.0-M1",
"wicket-jquery-ui-7.3.1",
"wicket-jquery-ui-7.3.0",
"wicket-jquery-ui-6.23.0",
"wicket-jquery-ui-6.22.2",
"wicket-jquery-ui-7.2.1",
"wicket-jquery-ui-6.22.1",
"wicket-jquery-ui-6.22.0",
"wicket-jquery-ui-6.21.2",
"wicket-jquery-ui-6.21.1",
"wicket-jquery-ui-7.2.0",
"wicket-jquery-ui-6.21.0",
"wicket-jquery-ui-7.1.0",
"wicket-jquery-ui-6.20.3",
"wicket-jquery-ui-6.20.2",
"wicket-jquery-ui-7.0.2",
"wicket-jquery-ui-6.20.1",
"wicket-jquery-ui-7.0.1",
"wicket-jquery-ui-7.0.0",
"wicket-jquery-ui-6.20.0",
"wicket-jquery-ui-6.19.1",
"wicket-jquery-ui-6.19.0",
"wicket-jquery-ui-6.18.1",
"wicket-jquery-ui-6.18.0",
"wicket-jquery-ui-6.17.0",
"wicket-jquery-ui-6.16.0",
"wicket-jquery-ui-6.15.0",
"wicket-jquery-ui-6.14.0",
"wicket-jquery-ui-6.13.1",
"wicket-jquery-ui-6.13.0",
"wicket-jquery-ui-6.12.0",
"wicket-jquery-ui-parent-6.11.0",
"wicket-jquery-ui-6.10.0",
"wicket-jquery-ui-6.9.1",
"wicket-jquery-ui-6.9.0",
"wicket-jquery-ui-6.8.1",
"wicket-jquery-ui-6.8.0",
"wicket-jquery-ui-6.7.0",
"wicket-jquery-1.4.2",
"wicket-jquery-ui-1.4.1",
"wicket-jquery-ui-1.4.0",
"wicket-jquery-ui-1.3.1",
"wicket-jquery-ui-1.3.0",
"wicket-jquery-ui-1.2.2",
"jquery-ui-parent-1.2.1",
"wicket-jquery-ui-1.2.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-15719.json"
}
}
],
"modified": "2026-10-24T10:30:25.463001872Z",
"provider": "osv",
"references": [
"https://github.com/sebfz1/wicket-jquery-ui/wiki#cve-2017-15719---xss-in-wysiwyg-editor"
],
"provider_metadata": {}
},
"related_cves": [
{
"value": "CVE-2017-15719",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 431364,
"published_at": "2018-03-12T13:29:00.273+00:00"
}