CVE-2025-6725: Progress Software Kendo UI For Angular

Medium severity, CVSS 5.4. EPSS: 0.3% chance of exploitation in the next 30 days.

In the PdfViewer component, a Cross-Site Scripting (XSS) vulnerability is possible if a specially-crafted document has already been loaded and the user engages with a tool that requires the DOM to be re-rendered.

Affected products

• Progress Software Kendo UI For Angular: from 18.5.0, up to and including 19.1.2
• Progress Software Kendo UI For jQuery: from 2024.4.1112, up to and including 2025.2.520
• Progress Software Kendoreact: from 5.10.0, up to and including 11.1.0
• Progress Software Telerik UI For ASP.NET Core: from 2024.4.1112, up to and including 2025.2.520
• Progress Software Telerik UI For ASP.NET Mvc: from 2024.4.1112, up to and including 2025.2.520
• Progress Software Telerik UI For Blazor: from 3.6.0, up to and including 9.0.0

Published 2025-07-02. Last modified 2026-06-17.