jquery-ui vulnerabilities

Latest jquery-ui CVEs

Newest publication first

1. CVE-2022-31160 jQuery UI contains potential XSS vulnerability when refreshing a checkboxradio with an HTML-like initial text label

   Published 2022-07-20

   Medium·CVSS 6.1 EPSS 2.7% PoC

   jQuery UI is a curated set of user interface interactions, effects, widgets, and themes built on top of jQuery. Versions prior to 1.13.2 are potentially vulnerable to cross-site scripting. Initializing a checkboxradio widget on an input enclosed within a label makes that parent l...

2. CVE-2021-41184 XSS in the `of` option of the `.position()` util

   Published 2021-10-26

   Medium·CVSS 6.1 EPSS 40.8%

   jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the of option of the .position() util from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. Any string value passed to the of option is no...

3. CVE-2021-41182 XSS in the `altField` option of the Datepicker widget

   Published 2021-10-26

   Medium·CVSS 6.1 EPSS 39.4% PoC

   jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the altField option of the Datepicker widget from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. Any string value passed to the altField...

4. CVE-2021-41183 XSS in `*Text` options of the Datepicker widget

   Published 2021-10-26

   Medium·CVSS 6.1 EPSS 8.5%

   jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of various *Text options of the Datepicker widget from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. The values passed to various *Text op...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.