In WebService binding scenario, the text of the items is not encoded and HTML code might get executed.
In Server-side Load on Demand binding this is not observed.
The following code can be used as a temporary workaround for WebService binding scenario:
Given a RadComboBox with search, if the user enters some search text and then clicks on one of the filtered entries in the dropdown list the validation event is fired as the entry box loses focus and results in a 'false' return from validation as it uses the 'Text' property which is the search string. Validation is then refired as a result of clicking on the entry. However, the initial 'false' return can cause unwanted behaviour in code that depends on the validation event. I can supply a sample project demonstrating the problem, but it needs more than the 10 MB upload limit.
"Loading..." text in Combobox with Virtual Scrolling is visible on first set of items loading. It shows first time "Loading..." text. on scrolling it loads items from PageMethods/WebService but "Loading..." text it not visible i.e. because it is first <LI> item so it is not visible. Instead of first <LI> item, it should be at position where it always display while loading more items. same issue is also in telerik demo website : http://demos.telerik.com/aspnet-ajax/combobox/examples/populatingwithdata/autocompletesql/defaultcs.aspx