Look up vulnerabilities by software, product or CVE number.
| CVE | Published | CVSS | ShadowTrackr CVSS | Summary |
|---|---|---|---|---|
CVE: CVE-2026-8866 | Published 2026-05-27 | CVSS: 6.4 | ShadowTrackr CVSS: 0.6 | Summary: The jQuery googleslides plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'googleslides' shortcode in all versions up to, and including, 1.3. This is due to insufficient input sanitization and output escaping on user supplied attributes (userid, albumid, authkey, imgmax, maxresults, random, caption, albumlink, time, and fadespeed) in the googleslides_handler() function, which interpolates the attribute values directly into single-quoted HTML attributes without using esc_attr(). This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. |
CVE: CVE-2026-10738 | Published 2026-06-09 | CVSS: 6.4 | ShadowTrackr CVSS: 0.6 | Summary: The jQuery Hover Footnotes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Footnote Qualifier ('{{...}}' Syntax) in all versions up to, and including, 1.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The attribute-breakout payload (e.g., a double-quote followed by an event handler) contains no angle brackets and therefore bypasses WordPress core's wp_kses_post() filtering, which only strips disallowed HTML tags rather than sanitizing attribute contexts. |
CVE: CVE-2026-10553 | Published 2026-06-09 | CVSS: 4.3 | ShadowTrackr CVSS: 0.5 | Summary: The jQuery Hover Footnotes plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4. This is due to missing or incorrect nonce validation on the jqFootnotes_options_subpanel function. This makes it possible for unauthenticated attackers to update the plugin's settings with arbitrary values that, because option values such as jqfoot_anchor_open, jqfoot_anchor_close, and jqfoot_title are echoed unescaped into frontend page content, can be chained into persistent Cross-Site Scripting affecting all site visitors via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Successful exploitation of the CSRF vulnerability can be chained into stored Cross-Site Scripting, as the overwritten option values are persisted via update_option() without sanitization and rendered unescaped on the frontend. |
CVE: CVE-2025-3650 | Published 2025-09-12 | CVSS: 3.5 | ShadowTrackr CVSS: 0.2 | Summary: The jQuery Colorbox WordPress plugin through 4.6.3 uses the colorbox library, which does not sanitize title attributes on links before using them, allowing users with at least the contributor role to conduct XSS attacks against administrators. |
CVE: CVE-2025-3573 | Published 2025-04-15 | CVSS: 5.3 | ShadowTrackr CVSS: 1.3 | Summary: Versions of the package jquery-validation before 1.20.0 are vulnerable to Cross-site Scripting (XSS) in the showLabel() function, which may take input from a user-controlled placeholder value. This value will populate a message via $.validator.messages in a user localizable dictionary. |
CVE: CVE-2025-30560 | Published 2025-03-24 | CVSS: 7.1 | ShadowTrackr CVSS: 0.5 | Summary: Cross-Site Request Forgery (CSRF) vulnerability in Sana Ullah jQuery Dropdown Menu jquery-drop-down-menu-plugin allows Stored XSS.This issue affects jQuery Dropdown Menu: from n/a through <= 3.0. |
CVE: CVE-2025-22546 | Published 2025-01-07 | CVSS: 6.5 | ShadowTrackr CVSS: 1.1 | Summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Obaid Hossain jQuery TwentyTwenty js-twentytwenty allows Stored XSS.This issue affects jQuery TwentyTwenty: from n/a through <= 1.0. |
CVE: CVE-2024-4783 | Published 2024-05-23 | CVSS: 6.4 | ShadowTrackr CVSS: 0.6 | Summary: The jQuery T(-) Countdown Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's tminus shortcode in all versions up to, and including, 2.3.25 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. CVE-2024-37247 may be a duplicate of this issue. |
CVE: CVE-2024-37247 | Published 2024-06-26 | CVSS: 6.5 | ShadowTrackr CVSS: 0.4 | Summary: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in twinpictures, baden03 jQuery T(-) Countdown Widget allows Stored XSS.This issue affects jQuery T(-) Countdown Widget: from n/a through 2.3.25. |
CVE: CVE-2023-5464 | Published 2023-10-31 | CVSS: 8.8 | ShadowTrackr CVSS: 6.8 | Summary: The Jquery accordion slideshow plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 8.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with subscriber-level and above permissions to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. |
CVE: CVE-2023-5432 | Published 2023-12-19 | CVSS: 6.4 | ShadowTrackr CVSS: 1.3 | Summary: The Jquery news ticker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'jquery-news-ticker' shortcode in versions up to, and including, 3.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. |
CVE: CVE-2023-5430 | Published 2023-10-31 | CVSS: 8.8 | ShadowTrackr CVSS: 6.8 | Summary: The Jquery news ticker plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 3.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with subscriber-level and above permissions to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. |
CVE: CVE-2023-4890 | Published 2023-09-12 | CVSS: 6.4 | ShadowTrackr CVSS: 1.3 | Summary: The JQuery Accordion Menu Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'dcwp-jquery-accordion' shortcode in versions up to, and including, 3.1.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. |
CVE: CVE-2023-0171 | Published 2023-02-06 | CVSS: 5.4 | ShadowTrackr CVSS: 1.1 | Summary: The jQuery T(-) Countdown Widget WordPress plugin before 2.3.24 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. |
CVE: CVE-2022-31160 | Published 2022-07-20 | CVSS: 6.1 | ShadowTrackr CVSS: 1.2 | Summary: jQuery UI is a curated set of user interface interactions, effects, widgets, and themes built on top of jQuery. Versions prior to 1.13.2 are potentially vulnerable to cross-site scripting. Initializing a checkboxradio widget on an input enclosed within a label makes that parent label contents considered as the input label. Calling `.checkboxradio( "refresh" )` on such a widget and the initial HTML contained encoded HTML entities will make them erroneously get decoded. This can lead to potentially executing JavaScript code. The bug has been patched in jQuery UI 1.13.2. To remediate the issue, someone who can change the initial HTML can wrap all the non-input contents of the `label` in a `span`. |
CVE: CVE-2022-31147 | Published 2022-07-14 | CVSS: 7.5 | ShadowTrackr CVSS: 6.9 | Summary: The jQuery Validation Plugin (jquery-validation) provides drop-in validation for forms. Versions of jquery-validation prior to 1.19.5 are vulnerable to regular expression denial of service (ReDoS) when an attacker is able to supply arbitrary input to the url2 method. This is due to an incomplete fix for CVE-2021-43306. Users should upgrade to version 1.19.5 to receive a patch. |
CVE: CVE-2022-30241 | Published 2022-05-04 | CVSS: 6.1 | ShadowTrackr CVSS: 1.2 | Summary: The jquery.json-viewer library through 1.4.0 for Node.js does not properly escape characters such as < in a JSON object, as demonstrated by a SCRIPT element. |
CVE: CVE-2022-24985 | Published 2022-02-16 | CVSS: 8.8 | ShadowTrackr CVSS: 6.8 | Summary: Forms generated by JQueryForm.com before 2022-02-05 allows a remote authenticated attacker to bypass authentication and access the administrative section of other forms hosted on the same web server. This is relevant only when an organization hosts more than one of these forms on their server. |
CVE: CVE-2022-24984 | Published 2022-02-16 | CVSS: 9.8 | ShadowTrackr CVSS: 8.2 | Summary: Forms generated by JQueryForm.com before 2022-02-05 (if file-upload capability is enabled) allow remote unauthenticated attackers to upload executable files and achieve remote code execution. This occurs because file-extension checks occur on the client side, and because not all executable content (e.g., .phtml or .php.bak) is blocked. |
CVE: CVE-2022-24983 | Published 2022-02-16 | CVSS: 7.5 | ShadowTrackr CVSS: 6.9 | Summary: Forms generated by JQueryForm.com before 2022-02-05 allow remote attackers to obtain the URI to any uploaded file by capturing the POST response. When chained with CVE-2022-24984, this could lead to unauthenticated remote code execution on the underlying web server. This occurs because the Unique ID field is contained in the POST response upon submitting a form. |
CVE: CVE-2022-24982 | Published 2022-02-16 | CVSS: 6.5 | ShadowTrackr CVSS: 5.4 | Summary: Forms generated by JQueryForm.com before 2022-02-05 allows a remote authenticated attacker to access the cleartext credentials of all other form users. admin.php contains a hidden base64-encoded string with these credentials. |
CVE: CVE-2022-24981 | Published 2022-02-16 | CVSS: 6.1 | ShadowTrackr CVSS: 1.2 | Summary: A reflected cross-site scripting (XSS) vulnerability in forms generated by JQueryForm.com before 2022-02-05 allows remote attackers to inject arbitrary web script or HTML via the redirect parameter to admin.php. |
CVE: CVE-2022-23395 | Published 2022-03-02 | CVSS: 6.1 | ShadowTrackr CVSS: 0.5 | Summary: jQuery Cookie 1.4.1 is affected by prototype pollution, which can lead to DOM cross-site scripting (XSS). |
CVE: CVE-2022-2144 | Published 2022-07-17 | CVSS: 4.3 | ShadowTrackr CVSS: 1.2 | Summary: The Jquery Validation For Contact Form 7 WordPress plugin before 5.3 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change Blog options like default_role, users_can_register via a CSRF attack |
CVE: CVE-2021-43862 | Published 2021-12-30 | CVSS: 3.7 | ShadowTrackr CVSS: 0.4 | Summary: jQuery Terminal Emulator is a plugin for creating command line interpreters in your applications. Versions prior to 2.31.1 contain a low impact and limited cross-site scripting (XSS) vulnerability. The code for XSS payload is always visible, but an attacker can use other techniques to hide the code the victim sees. If the application uses the `execHash` option and executes code from URL, the attacker can use this URL to execute their code. The scope is limited because the javascript attribute used is added to span tag, so no automatic execution like with `onerror` on images is possible. This issue is fixed in version 2.31.1. As a workaround, the user can use formatting that wrap whole user input and its no op. The code for this workaround is available in the GitHub Security Advisory. The fix will only work when user of the library is not using different formatters (e.g. to highlight code in different way). |
CVE: CVE-2021-43306 | Published 2022-06-01 | CVSS: 5.9 | ShadowTrackr CVSS: 4.6 | Summary: An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the jquery-validation npm package, when an attacker is able to supply arbitrary input to the url2 method |
CVE: CVE-2021-41184 | Published 2021-10-26 | CVSS: 6.5 | ShadowTrackr CVSS: 5.0 | Summary: jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the `of` option of the `.position()` util from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. Any string value passed to the `of` option is now treated as a CSS selector. A workaround is to not accept the value of the `of` option from untrusted sources. |
CVE: CVE-2021-41183 | Published 2021-10-26 | CVSS: 6.5 | ShadowTrackr CVSS: 5.0 | Summary: jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of various `*Text` options of the Datepicker widget from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. The values passed to various `*Text` options are now always treated as pure text, not HTML. A workaround is to not accept the value of the `*Text` options from untrusted sources. |
CVE: CVE-2021-41182 | Published 2021-10-26 | CVSS: 6.5 | ShadowTrackr CVSS: 5.0 | Summary: jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the `altField` option of the Datepicker widget from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. Any string value passed to the `altField` option is now treated as a CSS selector. A workaround is to not accept the value of the `altField` option from untrusted sources. |
CVE: CVE-2021-37504 | Published 2022-02-25 | CVSS: 6.1 | ShadowTrackr CVSS: 0.5 | Summary: A cross-site scripting (XSS) vulnerability in the fileNameStr parameter of jQuery-Upload-File v4.0.11 allows attackers to execute arbitrary web scripts or HTML via a crafted file with a Javascript payload in the file name. |
CVE: CVE-2021-34663 | Published 2021-08-16 | CVSS: 6.1 | ShadowTrackr CVSS: 1.2 | Summary: The jQuery Tagline Rotator WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to the use of $_SERVER['PHP_SELF'] in the ~/jquery-tagline-rotator.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 0.1.5. |
CVE: CVE-2021-32850 | Published 2023-02-20 | CVSS: 6.1 | ShadowTrackr CVSS: 0.5 | Summary: jQuery MiniColors is a color picker built on jQuery. Prior to version 2.3.6, jQuery MiniColors is prone to cross-site scripting when handling untrusted color names. This issue is patched in version 2.3.6. |
CVE: CVE-2021-24543 | Published 2021-10-25 | CVSS: 6.1 | ShadowTrackr CVSS: 1.2 | Summary: The jQuery Reply to Comment WordPress plugin through 1.31 does not have any CSRF check when saving its settings, nor sanitise or escape its 'Quote String' and 'Reply String' settings before outputting them in Comments, leading to a Stored Cross-Site Scripting issue. |
CVE: CVE-2021-21252 | Published 2021-01-13 | CVSS: 5.3 | ShadowTrackr CVSS: 1.7 | Summary: The jQuery Validation Plugin provides drop-in validation for your existing forms. It is published as an npm package "jquery-validation". jquery-validation before version 1.19.3 contains one or more regular expressions that are vulnerable to ReDoS (Regular Expression Denial of Service). This is fixed in 1.19.3. |
CVE: CVE-2021-20087 | Published 2021-04-23 | CVSS: 8.8 | ShadowTrackr CVSS: 6.8 | Summary: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in jquery-deparam 0.5.1 allows a malicious user to inject properties into Object.prototype. |
CVE: CVE-2021-20086 | Published 2021-04-23 | CVSS: 8.8 | ShadowTrackr CVSS: 6.8 | Summary: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in jquery-bbq 1.2.1 allows a malicious user to inject properties into Object.prototype. |
CVE: CVE-2021-20084 | Published 2021-04-23 | CVSS: 8.8 | ShadowTrackr CVSS: 6.8 | Summary: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in jquery-sparkle 1.5.2-beta allows a malicious user to inject properties into Object.prototype. |
CVE: CVE-2021-20083 | Published 2021-04-23 | CVSS: 8.8 | ShadowTrackr CVSS: 6.8 | Summary: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in jquery-plugin-query-object 2.2.3 allows a malicious user to inject properties into Object.prototype. |
CVE: CVE-2020-7656 | Published 2020-05-19 | CVSS: 6.1 | ShadowTrackr CVSS: 1.2 | Summary: jquery prior to 1.9.0 allows Cross-site Scripting attacks via the load method. The load method fails to recognize and remove "<script>" HTML tags that contain a whitespace character, i.e: "</script >", which results in the enclosed script logic to be executed. |
CVE: CVE-2019-11358 | Published 2019-04-19 | CVSS: 6.1 | ShadowTrackr CVSS: 1.2 | Summary: jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Object.prototype. |
CVE: CVE-2018-9208 | Published 2018-11-05 | CVSS: 9.8 | ShadowTrackr CVSS: 8.2 | Summary: Unauthenticated arbitrary file upload vulnerability in jQuery Picture Cut <= v1.1Beta |
CVE: CVE-2018-9207 | Published 2018-11-19 | CVSS: 9.8 | ShadowTrackr CVSS: 8.2 | Summary: Arbitrary file upload in jQuery Upload File <= 4.0.2 |
CVE: CVE-2018-9206 | Published 2018-10-11 | CVSS: 9.8 | ShadowTrackr CVSS: 9.2 | Summary: Unauthenticated arbitrary file upload vulnerability in Blueimp jQuery-File-Upload <= v9.22.0 |
CVE: CVE-2018-18405 | Published 2020-04-22 | CVSS: 6.1 | ShadowTrackr CVSS: 0.5 | Summary: jQuery v2.2.2 allows XSS via a crafted onerror attribute of an IMG element. NOTE: this vulnerability has been reported to be spam entry |
CVE: CVE-2017-16045 | Published 2018-06-04 | CVSS: 7.5 | ShadowTrackr CVSS: 4.6 | Summary: `jquery.js` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm. |
CVE: CVE-2017-1000170 | Published 2017-11-17 | CVSS: 7.5 | ShadowTrackr CVSS: 6.9 | Summary: jqueryFileTree 2.1.5 and older Directory Traversal |
CVE: CVE-2016-10707 | Published 2018-01-18 | CVSS: 7.5 | ShadowTrackr CVSS: 6.9 | Summary: jQuery 3.0.0-rc.1 is vulnerable to Denial of Service (DoS) due to removing a logic that lowercased attribute names. Any attribute getter using a mixed-cased name for boolean attributes goes into an infinite recursion, exceeding the stack call limit. |
CVE: CVE-2015-9251 | Published 2018-01-18 | CVSS: 6.1 | ShadowTrackr CVSS: 1.2 | Summary: jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed. |
CVE: CVE-2015-7943 | Published 2017-10-18 | CVSS: 6.1 | ShadowTrackr CVSS: 0.5 | Summary: Open redirect vulnerability in the Overlay module in Drupal 7.x before 7.41, the jQuery Update module 7.x-2.x before 7.x-2.7 for Drupal, and the LABjs module 7.x-1.x before 7.x-1.8 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-3233. |
CVE: CVE-2015-1840 | Published 2015-07-26 | CVSS: - | ShadowTrackr CVSS: 0.0 | Summary: jquery_ujs.js in jquery-rails before 3.1.3 and 4.x before 4.0.4 and rails.js in jquery-ujs before 1.0.4, as used with Ruby on Rails 3.x and 4.x, allow remote attackers to bypass the Same Origin Policy, and trigger transmission of a CSRF token to a different-domain web server, via a leading space character in a URL within an attribute value. |
CVE: CVE-2014-8739 | Published 2020-02-08 | CVSS: 9.8 | ShadowTrackr CVSS: 9.2 | Summary: Unrestricted file upload vulnerability in server/php/UploadHandler.php in the jQuery File Upload Plugin 6.4.4 for jQuery, as used in the Creative Solutions Creative Contact Form (formerly Sexy Contact Form) before 1.0.0 for WordPress and before 2.0.1 for Joomla!, allows remote attackers to execute arbitrary code by uploading a PHP file with an PHP extension, then accessing it via a direct request to the file in files/, as exploited in the wild in October 2014. |
CVE: CVE-2014-6071 | Published 2018-01-16 | CVSS: 6.1 | ShadowTrackr CVSS: 1.2 | Summary: jQuery 1.4.2 allows remote attackers to conduct cross-site scripting (XSS) attacks via vectors related to use of the text method inside after. |
CVE: CVE-2013-4383 | Published 2014-01-31 | CVSS: - | ShadowTrackr CVSS: 0.0 | Summary: Cross-site scripting (XSS) vulnerability in the jQuery Countdown module 7.x-1.x before 7.x-1.1 for Drupal allows remote authenticated users with the "access administration pages" permission to inject arbitrary web script or HTML via unspecified vectors. |
CVE: CVE-2012-6708 | Published 2018-01-18 | CVSS: 6.1 | ShadowTrackr CVSS: 1.2 | Summary: jQuery before 1.9.0 is vulnerable to Cross-site Scripting (XSS) attacks. The jQuery(strInput) function does not differentiate selectors from HTML in a reliable fashion. In vulnerable versions, jQuery determined whether the input was HTML by looking for the '<' character anywhere in the string, giving attackers more flexibility when attempting to construct a malicious payload. In fixed versions, jQuery only deems the input to be HTML if it explicitly starts with the '<' character, limiting exploitability only to attackers who can control the beginning of a string, which is far less common. |
CVE: CVE-2012-6662 | Published 2014-11-24 | CVSS: - | ShadowTrackr CVSS: 0.0 | Summary: Cross-site scripting (XSS) vulnerability in the default content option in jquery.ui.tooltip.js in the Tooltip widget in jQuery UI before 1.10.0 allows remote attackers to inject arbitrary web script or HTML via the title attribute, which is not properly handled in the autocomplete combo box demo. |
CVE: CVE-2011-4969 | Published 2013-03-08 | CVSS: - | ShadowTrackr CVSS: 0.0 | Summary: Cross-site scripting (XSS) vulnerability in jQuery before 1.6.3, when using location.hash to select elements, allows remote attackers to inject arbitrary web script or HTML via a crafted tag. |
CVE: CVE-2010-5312 | Published 2014-11-24 | CVSS: 6.1 | ShadowTrackr CVSS: 1.2 | Summary: Cross-site scripting (XSS) vulnerability in jquery.ui.dialog.js in the Dialog widget in jQuery UI before 1.10.0 allows remote attackers to inject arbitrary web script or HTML via the title option. |
CVE: CVE-2007-2379 | Published 2007-04-30 | CVSS: - | ShadowTrackr CVSS: 0.0 | Summary: The jQuery framework exchanges data using JavaScript Object Notation (JSON) without an associated protection scheme, which allows remote attackers to obtain the data via a web page that retrieves the data through a URL in the SRC attribute of a SCRIPT element and captures the data using other JavaScript code, aka "JavaScript Hijacking." |