jqueryui jquery ui vulnerabilities

Latest jqueryui jquery ui CVEs

Newest publication first

1. CVE-2022-31160 jQuery UI contains potential XSS vulnerability when refreshing a checkboxradio with an HTML-like initial text label

   Published 2022-07-20

   Medium·CVSS 6.1 EPSS 2.7% PoC

   jQuery UI is a curated set of user interface interactions, effects, widgets, and themes built on top of jQuery. Versions prior to 1.13.2 are potentially vulnerable to cross-site scripting. Initializing a checkboxradio widget on an input enclosed within a label makes that parent l...

2. CVE-2021-41184 XSS in the `of` option of the `.position()` util

   Published 2021-10-26

   Medium·CVSS 6.1 EPSS 40.8%

   jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the of option of the .position() util from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. Any string value passed to the of option is no...

3. CVE-2021-41182 XSS in the `altField` option of the Datepicker widget

   Published 2021-10-26

   Medium·CVSS 6.1 EPSS 39.4% PoC

   jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the altField option of the Datepicker widget from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. Any string value passed to the altField...

4. CVE-2021-41183 XSS in `*Text` options of the Datepicker widget

   Published 2021-10-26

   Medium·CVSS 6.1 EPSS 8.5%

   jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of various *Text options of the Datepicker widget from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. The values passed to various *Text op...

5. CVE-2016-7103 jQuery-UI vulnerable to Cross-site Scripting in dialog closeText

   Published 2017-03-15

   Medium·CVSS 6.1 EPSS 29.2% PoC

   Cross-site scripting (XSS) vulnerability in jQuery UI before 1.12.0 might allow remote attackers to inject arbitrary web script or HTML via the closeText parameter of the dialog function.

6. CVE-2012-6662 jquery-ui Tooltip widget vulnerable to XSS

   Published 2014-11-24

   Medium·CVSS 4.3 EPSS 7.5%

   Cross-site scripting (XSS) vulnerability in the default content option in jquery.ui.tooltip.js in the Tooltip widget in jQuery UI before 1.10.0 allows remote attackers to inject arbitrary web script or HTML via the title attribute, which is not properly handled in the autocomplet...

7. CVE-2010-5312 Cross-site Scripting in jquery-ui

   Published 2014-11-24

   Medium·CVSS 6.1 EPSS 18.4% PoC

   Cross-site scripting (XSS) vulnerability in jquery.ui.dialog.js in the Dialog widget in jQuery UI before 1.10.0 allows remote attackers to inject arbitrary web script or HTML via the title option.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.