Cross-Site Scripting in Kendo UI for jQuery by Progress
CVE-2026-106153

5.4MEDIUM

Key Information:

Vendor

Progress Software
Status
Kendo Ui For Jquery
Vendor
CVE Published:
15 October 2026

What is CVE-2026-106153?

In Progress' Kendo UI for jQuery, earlier than version 2026.3.1015, there exists a vulnerability where the Calendar and MultiViewCalendar components improperly handle URL and title inputs. An attacker with limited privileges can manipulate these inputs to inject malicious JavaScript code into the application. When a user interacts with the affected calendar, their browser may execute this JavaScript, potentially exposing sensitive information and compromising data integrity.

Affected Version(s)

Kendo UI for jQuery 2011.3.1007 < 2026.3.1015

References

https://www.telerik.com/kendo-jquery-ui/documentation/kno...
vendor-advisory

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Abhishek Nandkumar Bhaskar (Abhi-Hackz)
.