The flaw exists in the Splitter and Window components of Kendo UI for jQuery from version 2011.2.804 onward and in the Tooltip component from 2013.1.319 onward. The components build iframes using user‑controlled URLs or the iframe title without proper sanitization or encoding, allowing an attacker with low privileges to inject HTML attributes and JavaScript event handlers. When the victim interacts with the affected component the injected script runs in the victim’s browser, compromising data confidentiality and integrity.

Progress Software’s Kendo UI for jQuery is affected. All installations using versions prior to 2026.3.1015 of the Splitter, Window, or Tooltip components are vulnerable. The issue applies to any web application that loads these components and permits an attacker to influence the Iframe URL or title values.

The vulnerability carries a CVSS score of 5.4, indicating moderate severity. The EPSS score is less than 1 %, suggesting a low probability of exploitation in the field. The flaw is not listed in CISA’s KEV catalog. An attacker can exploit it locally via injected values, and the attack vector is inferred to be local input manipulation because the attacker needs to supply forged parameters to the client‑side code. If successful, the attacker can run arbitrary JavaScript in the context of the victim’s session.