PerfoMetrix

All vulnerabilities · jQuery

jQuery XSS (CVE-2020-11022, CVE-2020-11023): Check Your jQuery Version

CVE-2020-11022CVE-2020-11023CVSS 6.1Actively exploited (CISA KEV)

jQuery before 3.5.0 can run attacker HTML through its DOM methods (cross-site scripting). Check the jQuery version your pages load and how to update safely.

Is your site affected? Check the jQuery version it shows

Passive check: we load your page like a visitor would and read the versions it announces. We never send exploits or attack the site. "Not affected" or "hidden" doesn’t prove a server is safe: a firewall or proxy can hide versions, and only the server itself can confirm its packages.

Affected and fixed versions

AffectedFixed in
>=1.0.3 <3.5.0
3.5.0

Before 3.5.0, jQuery’s DOM manipulation methods (.html(), .append() and others) could run script hidden in HTML even after the HTML had been cleaned, because of how jQuery pre-processed it (htmlPrefilter) and how it handled <option> elements. A site that puts user-supplied HTML into the page with jQuery could be used for cross-site scripting. CISA added CVE-2020-11023 to its list of actively exploited vulnerabilities in 2025.

Who is affected

Pages loading jQuery 1.0.3 up to 3.4.1, if they pass untrusted HTML to jQuery methods. Old themes and plugins often bundle jQuery 1.x or 2.x.

What our check looks at

We read the jQuery version from the script’s file name or path (for example jquery-1.12.4.min.js). We never download your scripts. Our vulnerable-library check also lists other known flaws in the libraries we find.

How to fix it

  1. Update to jQuery 3.5.0 or later (the current 3.x or 4.x release).
  2. Test your pages: 3.5 changed htmlPrefilter, which can affect old plugins. The jQuery Migrate plugin helps find code that needs changes.
  3. On WordPress, keep core updated (it ships a current jQuery) and replace themes or plugins that load their own old copy.

FAQ

We load jQuery from a CDN. Does it update itself?

No. A versioned CDN URL always serves the same old file; change the URL.

Is jQuery 1.12.4 safe if we never use .html()?

Plugins may use it on your behalf, and 1.x has other known flaws. Update.

Official advisory

Last updated October 27, 2026 · This product uses data from the NVD API but is not endorsed or certified by the NVD.

Monitor your site for free