CVE-2026-124687
HIGH
NVD
CVSS Score
7.1
Severity
HIGH
Published
Nov 11, 2026
Vendor
unknown
Description
In Progress® Kendo® UI for jQuery versions from 2022.2.621 prior to 2026.4.1111 the DropDownButton and SplitButton allow markup injection through the `id` and `target` attributes. An attacker who can influence these item values can break out of the attributes and inject markup, including event handlers. The issue is fixed in 2026.4.1111.