jQuery is a foundational JavaScript library deeply embedded across millions of web applications and sites, making even modest vulnerability counts in this component consequential at scale. The vendor's vulnerability profile centers on a single product and recurs through weakness classes including cross-site scripting, prototype pollution, information disclosure, and uncontrolled recursion—flaws typical of a widely-used client-side DOM-manipulation library. The exposure has an elevated tendency toward confirmed in-the-wild exploitation and frequently acquires public exploit code, reflecting the attractiveness of vulnerabilities in such a pervasive dependency. Defenders should treat jQuery advisories as high-priority for any web application inventory and account for transitive exposure across frameworks and plugins that bundle the library; live severity and exploitation counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Jquery over time
Signals from CVEs in this vendor scope (11 CVEs).
11 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2020-11023MEDIUM In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's | Apr 29, 2020 | 6.1 | 95 | YES | YES |
CVE-2020-11022MEDIUM In jQuery starting with 1.12.0 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append | Apr 29, 2020 | 6.1 | 83 | NO | YES |
CVE-2019-11358MEDIUM jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source ob | Apr 20, 2019 | 6.1 | 78 | NO | YES |
CVE-2012-6708MEDIUM jQuery before 1.9.0 is vulnerable to Cross-site Scripting (XSS) attacks. The jQuery(strInput) function does not differentiate selectors from HTML in a reliable fashion. In vulnerab | Jan 18, 2018 | 6.1 | 35 | NO | YES |
CVE-2020-7656MEDIUM jquery prior to 1.9.0 allows Cross-site Scripting attacks via the load method. The load method fails to recognize and remove "<script>" HTML tags that contain a whitespace characte | May 19, 2020 | 6.1 | 34 | NO | YES |
CVE-2015-9251MEDIUM jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses | Jan 18, 2018 | 6.1 | 34 | NO | NO |
CVE-2016-10707HIGH jQuery 3.0.0-rc.1 is vulnerable to Denial of Service (DoS) due to removing a logic that lowercased attribute names. Any attribute getter using a mixed-cased name for boolean attrib | Jan 18, 2018 | 7.5 | 25 | NO | NO |
CVE-2011-4969MEDIUM Cross-site scripting (XSS) vulnerability in jQuery before 1.6.3, when using location.hash to select elements, allows remote attackers to inject arbitrary web script or HTML via a c | Mar 8, 2013 | 4.3 | 25 | NO | NO |
CVE-2018-18405MEDIUM jQuery v2.2.2 allows XSS via a crafted onerror attribute of an IMG element. NOTE: this vulnerability has been reported to be spam entry | Apr 22, 2020 | 6.1 | 22 | NO | NO |
CVE-2014-6071MEDIUM jQuery 1.4.2 allows remote attackers to conduct cross-site scripting (XSS) attacks via vectors related to use of the text method inside after. | Jan 16, 2018 | 6.1 | 21 | NO | NO |
Signals from CVEs in this vendor scope (11 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Jquery.
Media articles that mention a CVE ID that affects a product developed by Jquery — matched by CVE ID, not by vendor name.