Kendo UI for JQuery

Progress Kendo UI for jQuery contains a vulnerability in the Grid and TreeList components where column-reorder drag clues parse header text as HTML, potentially allowing JavaScript execution.

Progress Kendo UI for jQuery versions 2026.3.1014 up to, but not including, 2026.4.1110 contain a vulnerability in the ActionSheet component where input fields are not encoded before rendering.

Progress Kendo UI for jQuery versions prior to 2026.4.1111 are vulnerable to markup injection in the TabStrip, PanelBar, and Menu widgets when a dataSource field is mapped to spriteCssClass, potentially leading to unauthorized JavaScript execution.

Progress Kendo UI for jQuery versions from 2022.2.621 prior to 2026.4.1111 contain a markup injection vulnerability in the DropDownButton and SplitButton components via the id and target attributes.