Kendo Ui For Jquery
Monthly
Remote, unauthenticated injection in the Progress Kendo UI for jQuery PivotGrid XMLA transport (all versions prior to v2026.3.1015) lets an attacker place crafted filter values into MDX predicates and the surrounding SOAP request body, altering the query issued to a backend XMLA/OLAP data source such as Microsoft SQL Server Analysis Services. The assessed impact is confidentiality-only (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, 7.5 HIGH) - data reachable through the configured XMLA connection may be read or exposed, but integrity and availability of the source are not affected. Only applications that render PivotGrid with the XMLA transport enabled and a reachable OLAP backend are exposed; no public exploit was identified at time of analysis and the issue is not confirmed as actively exploited.
Cross-site scripting in Progress Kendo UI for jQuery (versions prior to 2026.3.1015) allows an attacker to execute JavaScript in a victim's browser through the Calendar and MultiViewCalendar month content templates, which render data.url and data.title without URL sanitization or HTML attribute encoding. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) confirms this is an authenticated, low-privilege, user-interaction-dependent issue: the attacker must be able to influence the templated 'url' option value or the culture-derived 'title' values, and a victim must then interact with the affected widget. There is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV), so this is best treated as a conditional, medium-severity stored/DOM XSS risk that is neutralized by upgrading to 2026.3.1015 or later.
Cross-site scripting in Progress Kendo UI for jQuery's Validator affects versions from 2012.2.710 through 2026.3.1015, where validation messages read from data-msg-* attributes are decoded and then parsed as HTML, so text that was correctly escaped in the page attribute becomes active markup and event handlers when validation runs. An attacker with low privileges who can influence the content of a validation message, combined with a victim triggering the Validator, can execute JavaScript in the victim's browser and compromise the confidentiality and integrity of data accessible to the application. The vendor rates this CVSS 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N); no public exploit identified at time of analysis.
Cross-site scripting in Progress Kendo UI for jQuery (all versions prior to 2026.3.1015) allows an authenticated low-privileged actor who controls the URL value passed to iframe-backed Splitter, Window, or Tooltip components - or the title of a Window iframe - to inject HTML attributes and JavaScript event handlers into the generated iframe markup, executing script in a victim's browser context when that user interacts with the affected widget (CVSS 3.1 base 5.4, AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N). Splitter and Window have been affected since 2011.2.804 and Tooltip since 2013.1.319, so any application on an older Kendo UI for jQuery release that renders untrusted input into these components is exposed. Exploitation requires pre-existing privileges to set the component value plus a separate victim's interaction, making this a real but non-urgent issue; there is no public exploit identified at time of analysis and the CVE is not confirmed actively exploited (CISA KEV).
Cross-site scripting (DOM/stored) in Progress Kendo UI for jQuery prior to v2026.3.1015 allows an attacker who can influence Menu dataSource fields to inject JavaScript event-handler attributes that execute in a victim's browser when the affected Menu is interacted with. The flaw requires low privileges (PR:L) to write the attacker-controlled bound fields and user interaction (UI:R) to trigger execution, with a scope change (S:C) since the injected script runs in the host application's page context, affecting confidentiality and integrity of browser-accessible data. Progress has released a vendor patch in v2026.3.1015; no confirmed active exploitation or public exploit code was identified at time of analysis, and the issue is assessed as moderate severity rather than a mass-exploitation threat.
Cross-site scripting in Progress Kendo UI for jQuery prior to 2026.3.1015 allows an authenticated attacker with low privileges (CVSS PR:L) to inject extra HTML attributes and event handlers by modifying an imageUrl value consumed by the TabStrip, Menu, or PanelBar components. The vulnerable components insert the imageUrl into a single-quoted image src attribute without escaping, so a crafted value can break out of the attribute and execute JavaScript when a victim interacts with a page that renders the affected component (UI:R); successful exploitation can affect the confidentiality and integrity of data accessible to the application. No public exploit code or CISA KEV active exploitation was identified at time of analysis, and the vendor fix is version 2026.3.1015.
Stored cross-site scripting in the Progress Kendo UI for jQuery ListBox widget allows an attacker who can modify the data bound to a list item to execute JavaScript in a victim's browser whenever the affected item is rendered. The default item template outputs the bound dataTextField value as raw HTML without encoding, and every release from R1 2020 up to (but not including) 2026.3.1015 is exposed; no public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited. Exploitation is not unauthenticated: it requires write access to the persisted field feeding dataTextField (consistent with the CVSS PR:L rating) plus a victim loading the view that renders the poisoned item (UI:R), which keeps this at medium severity (CVSS 3.1 base 5.4) and limits realistic impact to applications that bind the ListBox to user-influenced data.
Cross-site scripting in Progress Kendo UI for jQuery (releases from v2020.1.114 through 2026.3.1015) lets an attacker who can influence data bound to a Badge widget inject HTML with event handlers that execute JavaScript in a victim's browser when the Badge renders that value. Because the Badge text method outputs string values as raw HTML rather than encoded text, the injected script runs in the origin of the hosting application, compromising the confidentiality and integrity of data that application can reach on the victim's behalf. Exploitation requires both write access to the bound data source (CVSS PR:L) and a victim subsequently loading the affected page (UI:R), giving a vendor score of 5.4; no public exploit code or confirmed active exploitation was identified at time of analysis, and version 2026.3.1015 fixes the issue.
Prototype pollution in Progress Kendo UI for jQuery versions prior to 2026.3.1015 lets an authenticated, low-privileged attacker who can supply data accepted by a model's Model.accept method - such as a crafted server response or record - inject unsafe keys like __proto__, constructor, or prototype into object prototypes, altering application behavior and potentially compromising the confidentiality and integrity of application data. The vendor-assigned CVSS 3.1 score is 5.4 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N), reflecting that exploitation requires some privilege level and user interaction and that real impact is gated on how the application consumes the polluted objects, with server-side JavaScript (Node) scenarios most exposed. The vendor has released a fix in version 2026.3.1015; no public exploit code or confirmed active exploitation has been identified at time of analysis.
Cross-site scripting in Progress Kendo UI for jQuery (versions 2022.3.1109 up to but not including 2026.3.1015) allows an attacker who can influence the URL of a ToolBar ButtonGroup button to inject extra HTML attributes - including an event handler - and execute JavaScript in a victim's browser when that button is interacted with. The flaw is unauthenticated from the network perspective (CVSS:3.1/AV:N/PR:N) but requires user interaction (UI:R) and is rated high complexity (AC:H) because the payload must break out of an unquoted attribute; impact is scoped to the application's browser context with low confidentiality and integrity effects (C:L/I:L/A:N, base score 4.7). This is a genuine but comparatively low-urgency issue: no public exploit code exists and there is no confirmation of active exploitation (not listed in CISA KEV), and the vendor has released a fix in version 2026.3.1015.
Stored/DOM cross-site scripting in Progress Kendo UI for jQuery (Scheduler widget, versions 2026.3.811 and earlier) allows an attacker who can control a scheduler resource's color value to inject extra HTML attributes - including event handlers - into the quoted event wrapper attributes rendered by the Day, Timeline, Month, and Agenda views, so JavaScript executes in a victim's browser when the affected event is interacted with. Successful exploitation compromises the confidentiality and integrity of data accessible to the host application, though severity is limited by high attack complexity (AC:H), mandatory victim interaction (UI:R), and the practical need for write access to resource data (assessed PR:L; the vendor published PR:N). No public exploit code has been identified at time of analysis and the issue is not known to be actively exploited; the vendor-released fix is version 2026.3.1015.
Cross-site scripting (XSS) in the PanelBar component of Progress Kendo UI for jQuery (versions 2019.2.514 through before 2026.3.1015) allows unauthenticated remote attackers who can influence PanelBar item URL values to inject additional HTML attributes, including event handlers, into a single-quoted href attribute, resulting in JavaScript execution in a victim's browser upon interaction with the crafted item. Exploitation requires that the target application binds the PanelBar to a data source with attacker-controllable URLs and that a victim interacts with the item, making it a moderate-severity issue (CVSS 4.7) with high attack complexity. No public exploit code has been identified at time of analysis, and the vulnerability is fully remediated by upgrading to version 2026.3.1015.
Cross-site scripting in the FileManager component of Progress Kendo UI for jQuery (versions 2023.3.1010 through 2026.3.1015) allows an attacker who can control or influence a file or folder name to inject HTML with event handlers that execute JavaScript in a victim's browser when the user drags that item, because the default drag hint renders the remote item name as raw HTML while the corresponding list items are correctly encoded. The vector is unauthenticated over the network (PR:N) but requires a user to actively drag the poisoned item and demands the attacker first seed a crafted name, so the CVSS 4.7 (Medium) score reflects a genuinely moderate priority - no public exploit code exists and there is no evidence of active exploitation. The issue is a client-side DOM XSS with scoped confidentiality and integrity impact (S:C/C:L/I:L/A:N) and is fixed in version 2026.3.1015.
Cross-site scripting in the Kendo UI for jQuery FileBrowser and ImageBrowser components (v2023.1.117 through pre-v2026.3.1015) lets a file or directory name containing script-related HTML execute JavaScript in the browser of any user who opens the affected browse dialog, compromising the confidentiality and integrity of data reachable in that application origin. Exploitation is conditional: an attacker must be able to influence the name of a file or directory that the component enumerates (typically via an upload or a shared storage path), and the payload only fires when a victim actually views the FileBrowser or ImageBrowser view - the independent assessment therefore scores this AV:N/AC:L/PR:L/UI:R (6.5) rather than the vendor's PR:N/UI:N vector. Impact is confined to the victim's browser context with no server-side code execution; no public exploit code was identified at time of analysis and there is no CISA KEV listing, but a fixed release (v2026.3.1015) is available.
Remote, unauthenticated injection in the Progress Kendo UI for jQuery PivotGrid XMLA transport (all versions prior to v2026.3.1015) lets an attacker place crafted filter values into MDX predicates and the surrounding SOAP request body, altering the query issued to a backend XMLA/OLAP data source such as Microsoft SQL Server Analysis Services. The assessed impact is confidentiality-only (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, 7.5 HIGH) - data reachable through the configured XMLA connection may be read or exposed, but integrity and availability of the source are not affected. Only applications that render PivotGrid with the XMLA transport enabled and a reachable OLAP backend are exposed; no public exploit was identified at time of analysis and the issue is not confirmed as actively exploited.
Cross-site scripting in Progress Kendo UI for jQuery (versions prior to 2026.3.1015) allows an attacker to execute JavaScript in a victim's browser through the Calendar and MultiViewCalendar month content templates, which render data.url and data.title without URL sanitization or HTML attribute encoding. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) confirms this is an authenticated, low-privilege, user-interaction-dependent issue: the attacker must be able to influence the templated 'url' option value or the culture-derived 'title' values, and a victim must then interact with the affected widget. There is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV), so this is best treated as a conditional, medium-severity stored/DOM XSS risk that is neutralized by upgrading to 2026.3.1015 or later.
Cross-site scripting in Progress Kendo UI for jQuery's Validator affects versions from 2012.2.710 through 2026.3.1015, where validation messages read from data-msg-* attributes are decoded and then parsed as HTML, so text that was correctly escaped in the page attribute becomes active markup and event handlers when validation runs. An attacker with low privileges who can influence the content of a validation message, combined with a victim triggering the Validator, can execute JavaScript in the victim's browser and compromise the confidentiality and integrity of data accessible to the application. The vendor rates this CVSS 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N); no public exploit identified at time of analysis.
Cross-site scripting in Progress Kendo UI for jQuery (all versions prior to 2026.3.1015) allows an authenticated low-privileged actor who controls the URL value passed to iframe-backed Splitter, Window, or Tooltip components - or the title of a Window iframe - to inject HTML attributes and JavaScript event handlers into the generated iframe markup, executing script in a victim's browser context when that user interacts with the affected widget (CVSS 3.1 base 5.4, AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N). Splitter and Window have been affected since 2011.2.804 and Tooltip since 2013.1.319, so any application on an older Kendo UI for jQuery release that renders untrusted input into these components is exposed. Exploitation requires pre-existing privileges to set the component value plus a separate victim's interaction, making this a real but non-urgent issue; there is no public exploit identified at time of analysis and the CVE is not confirmed actively exploited (CISA KEV).
Cross-site scripting (DOM/stored) in Progress Kendo UI for jQuery prior to v2026.3.1015 allows an attacker who can influence Menu dataSource fields to inject JavaScript event-handler attributes that execute in a victim's browser when the affected Menu is interacted with. The flaw requires low privileges (PR:L) to write the attacker-controlled bound fields and user interaction (UI:R) to trigger execution, with a scope change (S:C) since the injected script runs in the host application's page context, affecting confidentiality and integrity of browser-accessible data. Progress has released a vendor patch in v2026.3.1015; no confirmed active exploitation or public exploit code was identified at time of analysis, and the issue is assessed as moderate severity rather than a mass-exploitation threat.
Cross-site scripting in Progress Kendo UI for jQuery prior to 2026.3.1015 allows an authenticated attacker with low privileges (CVSS PR:L) to inject extra HTML attributes and event handlers by modifying an imageUrl value consumed by the TabStrip, Menu, or PanelBar components. The vulnerable components insert the imageUrl into a single-quoted image src attribute without escaping, so a crafted value can break out of the attribute and execute JavaScript when a victim interacts with a page that renders the affected component (UI:R); successful exploitation can affect the confidentiality and integrity of data accessible to the application. No public exploit code or CISA KEV active exploitation was identified at time of analysis, and the vendor fix is version 2026.3.1015.
Stored cross-site scripting in the Progress Kendo UI for jQuery ListBox widget allows an attacker who can modify the data bound to a list item to execute JavaScript in a victim's browser whenever the affected item is rendered. The default item template outputs the bound dataTextField value as raw HTML without encoding, and every release from R1 2020 up to (but not including) 2026.3.1015 is exposed; no public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited. Exploitation is not unauthenticated: it requires write access to the persisted field feeding dataTextField (consistent with the CVSS PR:L rating) plus a victim loading the view that renders the poisoned item (UI:R), which keeps this at medium severity (CVSS 3.1 base 5.4) and limits realistic impact to applications that bind the ListBox to user-influenced data.
Cross-site scripting in Progress Kendo UI for jQuery (releases from v2020.1.114 through 2026.3.1015) lets an attacker who can influence data bound to a Badge widget inject HTML with event handlers that execute JavaScript in a victim's browser when the Badge renders that value. Because the Badge text method outputs string values as raw HTML rather than encoded text, the injected script runs in the origin of the hosting application, compromising the confidentiality and integrity of data that application can reach on the victim's behalf. Exploitation requires both write access to the bound data source (CVSS PR:L) and a victim subsequently loading the affected page (UI:R), giving a vendor score of 5.4; no public exploit code or confirmed active exploitation was identified at time of analysis, and version 2026.3.1015 fixes the issue.
Prototype pollution in Progress Kendo UI for jQuery versions prior to 2026.3.1015 lets an authenticated, low-privileged attacker who can supply data accepted by a model's Model.accept method - such as a crafted server response or record - inject unsafe keys like __proto__, constructor, or prototype into object prototypes, altering application behavior and potentially compromising the confidentiality and integrity of application data. The vendor-assigned CVSS 3.1 score is 5.4 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N), reflecting that exploitation requires some privilege level and user interaction and that real impact is gated on how the application consumes the polluted objects, with server-side JavaScript (Node) scenarios most exposed. The vendor has released a fix in version 2026.3.1015; no public exploit code or confirmed active exploitation has been identified at time of analysis.
Cross-site scripting in Progress Kendo UI for jQuery (versions 2022.3.1109 up to but not including 2026.3.1015) allows an attacker who can influence the URL of a ToolBar ButtonGroup button to inject extra HTML attributes - including an event handler - and execute JavaScript in a victim's browser when that button is interacted with. The flaw is unauthenticated from the network perspective (CVSS:3.1/AV:N/PR:N) but requires user interaction (UI:R) and is rated high complexity (AC:H) because the payload must break out of an unquoted attribute; impact is scoped to the application's browser context with low confidentiality and integrity effects (C:L/I:L/A:N, base score 4.7). This is a genuine but comparatively low-urgency issue: no public exploit code exists and there is no confirmation of active exploitation (not listed in CISA KEV), and the vendor has released a fix in version 2026.3.1015.
Stored/DOM cross-site scripting in Progress Kendo UI for jQuery (Scheduler widget, versions 2026.3.811 and earlier) allows an attacker who can control a scheduler resource's color value to inject extra HTML attributes - including event handlers - into the quoted event wrapper attributes rendered by the Day, Timeline, Month, and Agenda views, so JavaScript executes in a victim's browser when the affected event is interacted with. Successful exploitation compromises the confidentiality and integrity of data accessible to the host application, though severity is limited by high attack complexity (AC:H), mandatory victim interaction (UI:R), and the practical need for write access to resource data (assessed PR:L; the vendor published PR:N). No public exploit code has been identified at time of analysis and the issue is not known to be actively exploited; the vendor-released fix is version 2026.3.1015.
Cross-site scripting (XSS) in the PanelBar component of Progress Kendo UI for jQuery (versions 2019.2.514 through before 2026.3.1015) allows unauthenticated remote attackers who can influence PanelBar item URL values to inject additional HTML attributes, including event handlers, into a single-quoted href attribute, resulting in JavaScript execution in a victim's browser upon interaction with the crafted item. Exploitation requires that the target application binds the PanelBar to a data source with attacker-controllable URLs and that a victim interacts with the item, making it a moderate-severity issue (CVSS 4.7) with high attack complexity. No public exploit code has been identified at time of analysis, and the vulnerability is fully remediated by upgrading to version 2026.3.1015.
Cross-site scripting in the FileManager component of Progress Kendo UI for jQuery (versions 2023.3.1010 through 2026.3.1015) allows an attacker who can control or influence a file or folder name to inject HTML with event handlers that execute JavaScript in a victim's browser when the user drags that item, because the default drag hint renders the remote item name as raw HTML while the corresponding list items are correctly encoded. The vector is unauthenticated over the network (PR:N) but requires a user to actively drag the poisoned item and demands the attacker first seed a crafted name, so the CVSS 4.7 (Medium) score reflects a genuinely moderate priority - no public exploit code exists and there is no evidence of active exploitation. The issue is a client-side DOM XSS with scoped confidentiality and integrity impact (S:C/C:L/I:L/A:N) and is fixed in version 2026.3.1015.
Cross-site scripting in the Kendo UI for jQuery FileBrowser and ImageBrowser components (v2023.1.117 through pre-v2026.3.1015) lets a file or directory name containing script-related HTML execute JavaScript in the browser of any user who opens the affected browse dialog, compromising the confidentiality and integrity of data reachable in that application origin. Exploitation is conditional: an attacker must be able to influence the name of a file or directory that the component enumerates (typically via an upload or a shared storage path), and the payload only fires when a victim actually views the FileBrowser or ImageBrowser view - the independent assessment therefore scores this AV:N/AC:L/PR:L/UI:R (6.5) rather than the vendor's PR:N/UI:N vector. Impact is confined to the victim's browser context with no server-side code execution; no public exploit code was identified at time of analysis and there is no CISA KEV listing, but a fixed release (v2026.3.1015) is available.