CVE-2026-124691
Cross-Site Scripting in Kendo UI for jQuery Gantt Parent Dropdown
CVSS Score
7.1
EPSS Score
0.0%
EPSS Percentile
0th
In Progress Kendo UI for jQuery Gantt, the task editor's Parent dropdown renders task titles as HTML. An attacker who can influence a task title shown in the dropdown can cause attacker-controlled markup to execute as JavaScript when a user opens or interacts with the task editor. Successful exploitation may compromise the confidentiality and integrity of data available in the user's browser context. The first affected version is 2020.3.915; the latest vulnerable version is 2026.3.1015. The issue is fixed in version 2026.4.1111.
| CWE | CWE-79 |
| Vendor | progress software |
| Product | kendo ui for jquery |
| Published | Nov 12, 2026 |
| Last Updated | Nov 12, 2026 |
Stay Ahead of the Next One
Get instant alerts for progress software kendo ui for jquery
Be the first to know when new high vulnerabilities affecting progress software kendo ui for jquery are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
Low
Affected Versions
Progress Software / Kendo UI for jQuery
2020.3.915 ≤ 2026.3.1015
References
Credits
Abhishek Nandkumar Bhaskar (Abhi-Hackz)