XSS Vulnerability

[Lc5]

Try out dropkick on following HTML:

<select class="dk">
    <option value="1">&lt;script&gt;alert('test')&lt;/script&gt;<option>
</select>

Actual: javascript is executed

Expected: option text "<script>alert('test')</script>" is displayed

Javascript is never exectued if you use regular select.

[Robdel12]

Thank you for the heads up! I've pushed changes :)

[Lc5]

Thank you for quick fix :)