A cross‑site scripting vulnerability exists in the ListBox component of Kendo UI for jQuery. When the component renders its bound dataTextField value, the value is inserted as raw HTML without escaping. An attacker who can influence the data can inject HTML that contains JavaScript event handlers, causing that script to execute in any browser that renders the affected list item. This can compromise the confidentiality of data accessed by the application and the integrity of that data by allowing manipulation or theft.

Progress Software’s Kendo UI for jQuery is affected. All releases from the initial R1 2020 through the version released just before 2026.3.1015 contain the vulnerable rendering logic, while 2026.3.1015 and later fix the issue.

The CVSS base score of 5.4 indicates moderate severity. The EPSS score of less than 1% suggests that, while the vulnerability can be exploited, it is unlikely to be widely attacked. This vulnerability is not currently listed in the CISA KEV catalog. Based on the description, it is inferred that the attacker’s ability to alter the data bound to the ListBox is required; therefore, the likely attack vector is via malicious user input or an exploited API that stores such data. The compromise would be limited to the context of the user’s browser session, but the impact could include unauthorized data access or data alteration.