medialize/jQuery-contextMenu — pull request #228 by gblock0 (2014-09-13 12:35:08+00:00)
Title: Changed .html() to .text()

The string passed to the menu items is eventually "eval"ed by jQuery, so using .html() allows XSS to get through and get executed by the browser.