CVE-2026-106150mediumCWE-79

CVE-2026-106150: medium-severity vulnerability in Progress Software Kendo UI for jQuery

Cross-site Scripting (XSS) in Kendo UI for jQuery Splitter, Window, and Tooltip

Published

Follow this CVE+ Monitor Kendo UI for jQuery

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.4epss 0.2%
In Progress® Kendo® UI for jQuery prior to 2026.3.1015, the Splitter and Window components starting with version 2011.2.804 and the Tooltip component starting with version 2013.1.319 construct iframe markup without properly sanitizing URL values or encoding the Window iframe title. An attacker with low privileges who can control these values can inject HTML attributes, including JavaScript event handlers, through an apostrophe in an iframe URL or a crafted title. When a user interacts with the affected component, injected JavaScript can execute in the user's browser context, compromising the confidentiality and integrity of accessible data.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected products
Progress Software · Kendo UI for jQuery
Related CVEs — Progress Software Kendo UI for jQuery

In the same product, most dangerous first.

CVE-2025-6725MEDIUMCross-Site Scripting (XSS) in PdfViewerEPSS 0.3%CVE-2026-108116HIGHMDX and SOAP Injection in Kendo UI for jQueryEPSS 0.3%CVE-2026-106160MEDIUMPrototype Pollution via Model.accept and kendo.setter in Kendo UI for jQueryEPSS 0.2%CVE-2026-106163MEDIUMCross-site Scripting (XSS) in Kendo UI for jQuery FileBrowser and ImageBrowserEPSS 0.2%CVE-2026-106153MEDIUMCross-site Scripting (XSS) in Kendo UI for jQuery Calendar and MultiViewCalendarEPSS 0.2%CVE-2026-106151MEDIUMCross-Site Scripting in Validator Validation Messages in Kendo UI for jQueryEPSS 0.2%