Cross-site Scripting (XSS)

chosen-js is vulnerable to cross-site scripting XSS attacks. The application does not properly escape the grouplabel before rendering it, allowing a malicious user to inject and execute arbitrary Javascript...