We scanned 2,080 .tr sites: half load a vulnerable JavaScript library

On 19 October 2026 we scanned the home pages of 2,363 .tr domains from the Tranco popularity list and reached 2,080 of them. 1,105 of those sites (53%) send at least one JavaScript library version with a known vulnerability to their visitors' browsers. 455 sites (21%) load a jQuery release older than 3.5.0, which carries CVE-2020-11023. CISA has listed that flaw in its Known Exploited Vulnerabilities catalog since 23 January 2025.

An old version does not mean the flaw is usable on that site. The jQuery bug only works if the site's own code takes outside HTML and inserts it with jQuery. Most of the Next.js findings apply only to Windows servers or to one specific way of checking access. If your site uses jQuery, upgrade to 3.5.0 or later; if it runs Next.js, move to the safe release in the table below. To see which versions your site loads, enter your domain in our JavaScript library scan. No account needed.

What we measured, and how

We took the sites from Tranco, a ranking built for research. We kept every .tr domain in its top million, then removed government (gov.tr, bel.tr, tsk.tr and similar), education (edu.tr, k12.tr) and infrastructure names (cdn, api, mail and so on). Several domains of the same organisation counted once. That left 2,363 domains.

Each site got one light scan. Our scanner downloaded the home page and the script files it loads, 24,081 files in total. We ran no code, sent no forms and went behind no login. We read a library's version in one of three ways:

• From the version line inside the file, such as /*! jQuery v1.12.4. 1,260 of the vulnerable copies were identified this way.
• From the file's SHA-256 hash matching the official npm release byte for byte. 636 copies; the version is certain even when the file does not print it.
• From the file's address, such as the version folder in a cdnjs URL. Only 7 copies.

We matched versions against the same data npm audit uses (GitHub Advisory Database and OSV) plus Retire.js. We checked that match against real npm audit output: across 69 versions we found all 241 advisories npm reported.

What we found

Finding	Sites	Share of 2,080 scanned
At least one library version read	1,738	83%
Library version with a known vulnerability	1,105	53%
Critical or high severity record (or exploited in the wild)	961	46%
Record exploited in the wild or with a public attack tool	571	27%
Library version past end of support	699	33%
Script loaded from a CDN without integrity (SRI)	438	21%
Public source map (.map)	246	11%

The vulnerable libraries we saw most often:

Library	Sites with a vulnerable version	Most common record
jQuery	455	CVE-2020-11023 (CISA KEV)
Swiper	242	CVE-2026-27212, prototype pollution, 6.5.1 – 12.1.1
Bootstrap	192	CVE-2019-8331, XSS via tooltip and popover
jQuery Validation	152	CVE-2025-3573, XSS in the error label, before 1.20.0
Next.js	145	See the separate section below
jQuery UI	108	CVE-2022-31160, checkboxradio XSS, before 1.13.2
Moment.js	97	CVE-2022-31129, slow regular expression
Handlebars	81	CVE-2026-33938, code injection during template compilation

Almost every one of these records depends on a condition. The Bootstrap and jQuery UI bugs only fire when the component in question (tooltip, date picker, checkbox) is fed a value from outside. Moment.js record CVE-2022-24785 affects Moment on the server (Node.js) only; for the copy in a browser it means nothing. That is why our scan shows the description of each record next to the finding.

jQuery: on 1,295 of 2,080 sites

jQuery loads on 62% of the sites we scanned. Grouped by the oldest jQuery copy on each site:

Oldest copy	Sites	Status
1.x	184	Out of support, has CVE-2020-11023
2.x	98	Out of support, has CVE-2020-11023
3.0 – 3.4	173	Has CVE-2020-11023, can move to 3.5.0
3.5 – 3.7	826	Not affected by this flaw
4.x	14	Not affected by this flaw

119 sites load more than one jQuery copy. Usually the page loads one version and a plugin or third-party widget (chat, map, form builder) brings its own. Of the 495 copies carrying CVE-2020-11023, the site serves 386 from its own server and 72 from a CDN; 32 arrive inside a third party's script. The site owner cannot update a third-party copy; the company behind that service has to.

None of the jQuery copies shipped with WordPress core had this flaw. Only 3 old copies came from WordPress folders, two from themes and one from a plugin. Old jQuery mostly arrives with ready-made site templates and hand-copied files.

Does this flaw actually work on your site?

CVE-2020-11023 comes from a mistake in how jQuery handles HTML containing an <option> element. According to the GitHub advisory, code can run even when that HTML has been sanitised first. Three things have to be true together:

1. The site takes a piece of HTML written by a visitor or another source (a comment, a search result, content from an API).
2. The site's code inserts that HTML with a jQuery method such as .html(), .append() or .prepend().
3. The jQuery on the page is older than 3.5.0.

A scan from the outside can only see the third condition. The first two can only be checked by someone who knows the site's code. Being on CISA's list shows the flaw has been used against at least one real target; FIRST's EPSS model put the chance of exploitation in the next 30 days at 84% as of 18 October 2026. Neither number describes your site, but neither gives you a reason to postpone the upgrade.

If you cannot upgrade right away, the advisory suggests cleaning the HTML with DOMPurify and its SAFE_FOR_JQUERY option before passing it to jQuery. Treat that as a stopgap; the upgrade is the fix.

Will upgrading break the site?

Moving from 1.x or 2.x to 3.x can break older plugins. The jQuery team's jQuery Migrate plugin restores removed methods for a while and logs which code needs changing in the browser console. 221 of the sites we scanned already load jQuery Migrate. A safe route: on a staging copy, load 3.7.1 together with Migrate, fix the console warnings, then remove Migrate.

Next.js: on 164 sites, most findings are conditional

164 sites run Next.js, and on 145 the version matches a known record. In Next.js the version in the browser bundle is the version running on the server, so these findings concern the server too.

All 117 Next.js findings in the "exploited or public attack tool" class come from two records, and both carry a strong condition:

Record	Condition	Sites	Safe release
CVE-2026-75604 (CVSS 9.0, Metasploit module available)	Only Next.js running on a Windows server	96	15.5.24 or 16.3.3
CVE-2025-29927 (CVSS 9.1, Metasploit module available)	Only if access checks happen in middleware	28	12.3.5 · 13.5.9 · 14.2.25 · 15.2.3

To see whether these records apply, we looked at the servers' response headers. Of the 96 sites matching CVE-2026-75604, headers on 3 point to a Windows server (IIS or ASP.NET) and 4 run on Vercel, which is not Windows. On 86 the headers say nothing about the operating system, and 3 did not answer a second request. Most of these findings probably do not affect those sites, but we cannot be certain from the outside.

For CVE-2025-29927, the Next.js advisory says sites hosted on Vercel are protected automatically. If you run your own server with next start and check sessions in middleware, upgrade first. If you cannot, the advisory recommends blocking outside requests that carry the x-middleware-subrequest header before they reach the app.

Out-of-support versions: 699 sites

A branch past end of support gets no fixes for new flaws. The most common, according to endoflife.date:

Branch	Sites
Bootstrap 4	210
jQuery 1	184
Bootstrap 3	147
jQuery 2	102
jQuery UI 1.13	45
jQuery UI 1.12	43
Vue.js 3.2	39
Next.js 14	27

Bootstrap 4 may have no critical flaw today, but a fix for tomorrow's will not reach this branch. Planning the upgrade before that happens is cheaper.

Supply chain: where do your scripts come from?

When a script loads from another server (a CDN), any change to the file there changes the code on your site. The integrity (SRI) attribute lets the browser check that the file has not changed. 438 sites load at least one CDN script without it. On 201 of them our scan gives a ready integrity value to copy, because the file matches the official release byte for byte. On 130 sites the CDN address does not pin an exact version (for example jquery@3), so the file can change silently and integrity cannot be added.

One site still references polyfill.io, the domain that changed hands in 2024 and began sending visitors to scam sites. Our scanner never downloads files from such addresses; it only reports that the page names them.

On 9 sites, code had been appended to a library's official file. We opened each one: none showed signs of sending data to an outside address, hiding code or reading card fields. The additions were small fixes of the site's own, such as touch event settings; on two sites the jQuery file had been copied together with code the Internet Archive (Wayback Machine) injects. That is harmless, but it shows nobody knows where the file came from.

246 sites leave their scripts' source maps (.map) public. A source map holds the readable version of minified code and often the site's folder structure. It is not a vulnerability, but it makes an attacker's job easier.

We found no server-side secret (Stripe, AWS, GitHub and the like) in any site's scripts. 110 sites expose a Google API key; that is normal for browser code, but the key should be restricted in the Google Cloud console to the right domains and APIs.

What to do on your site

1. Enter your domain in the JavaScript library scan. For each library it shows the line the version was read from, every file it read and the safe release on the same branch.
2. If jQuery is older than 3.5.0, upgrade it. If the copy comes from a WordPress plugin or theme, update that component; WP Lens checks the plugins on a WordPress site for their own flaws.
3. If you run Next.js, check your server's operating system and where access checks happen, then move to the safe release in the table above.
4. Pin the exact version in every CDN script address and add integrity.
5. If you have the code, match your package-lock.json, yarn.lock or composer.lock on the SBOM page. Dependencies invisible from the outside get checked as well.
6. New advisories appear every day. Add your site to a free account and run this scan; if a new record lands for a library version from your latest scan, we will tell you.

Not sure whether a finding applies to your site? Write to us and we will look at it together.

Limits of this study

• We read the home page and the scripts it loads, nothing else. Pages behind a login, scripts loaded later and server-side dependencies are not in these numbers, so the real rates may be higher.
• Of the 2,363 domains, a firewall blocked our scan on 119, 79 did not answer and 85 had no DNS record. They are not counted.
• A library whose version we could not read was not counted as "not vulnerable"; it is not in the numbers at all.
• We removed vendor builds that may carry backported patches (versions containing "-sec", "-aem" or "-joomla").
• A vulnerable version does not show that the flaw is usable on that site. The numbers here show sites that need an update, not sites open to attack.

Method

• Sample: .tr domains in the Tranco top million, excluding government, education and infrastructure names and repeats of the same organisation (2,363 domains).
• Scan date: 19 October 2026. Scanner identity NoroxiTools/1.0; at most 6 sites at once, at most 30 files per site.
• Version: version line in the file, official release hash (SHA-256) or file address.
• Vulnerability data: GitHub Advisory Database, OSV, Retire.js. KEV status from CISA's catalog, EPSS from FIRST, end of support from endoflife.date.
• Server operating system read from response headers only (Server, X-Powered-By); when headers said nothing we counted it as unknown.
• Percentages are rounded down. We do not publish the name of any site.

Sources

• Tranco popularity list: tranco-list.eu
• CISA Known Exploited Vulnerabilities catalog: cisa.gov
• CVE-2020-11023 advisory: GHSA-jpcq-cgw6-v4j6
• jQuery 3.5.0 release notes: blog.jquery.com
• CVE-2026-75604 advisory: GHSA-p293-qw3h-jr36
• CVE-2025-29927 advisory: GHSA-f82v-jwr5-mffw
• EPSS: first.org/epss
• End-of-support data: endoflife.date