Description
In Progress® Kendo® UI for jQuery versions from 2022.2.621 prior to 2026.4.1111 the DropDownButton and SplitButton allow markup injection through the `id` and `target` attributes. An attacker who can influence these item values can break out of the attributes and inject markup, including event handlers. The issue is fixed in 2026.4.1111.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Progress Software | Kendo UI for jQuery | 2022.2.621 <2026.4.1111 | — |