Skip to content
Noroxi

jQuery UI vulnerabilitiesjQuery UI: known vulnerabilities and safe versions

npm: jquery-ui

jQuery UI has 7 known vulnerability records: 7 in the npm advisory data (GitHub Advisory Database via OSV, the same source npm audit uses). The latest release is 1.14.2 (endoflife.date).

By branch: 1.14.x has no known records; 1.13.x is safe from 1.13.2; 1.12.x has no fixed release in the records; 1.11.x has no fixed release in the records.

Vulnerabilities and safe version by branch

Safe version: on that branch, this release and every later one (up to the branch's latest release, where known) fall outside every known record's range. Candidates are only the records' own fixed versions and the branch's latest release; "No fix" means moving off the branch.

BranchSupportLatest on branchRecordsSafe version
1.14.xSupported1.14.20—
1.13.xEnded (August 5, 2024)1.13.31medium1.13.2
1.12.xEnded (October 7, 2021)1.12.14mediumNo fix
1.11.xEnded (April 21, 2016)1.11.45mediumNo fix
1.10.xEnded (June 26, 2014)1.10.45mediumNo fix
1.9.xEnded (January 17, 2013)1.9.27mediumNo fix
1.8.xEnded (October 8, 2012)1.8.247mediumNo fix
1.7.xEnded (March 23, 2010)1.7.37mediumNo fix

Records

Newest first. Ranges are the record's own data; several ranges mean separate fixes per branch.

  • CVE-2022-31160exploit code exists2022-07-20

    jQuery UI contains potential XSS vulnerability when refreshing a checkboxradio with an HTML-like initial text label

    Affected versions: < 1.13.2

    medium 6.1

    Fixed in: 1.13.2

    EPSS 2.6%

  • CVE-2021-41184exploit code exists2021-10-26

    XSS in the `of` option of the `.position()` util

    Affected versions: < 1.13.0

    medium 6.1

    Fixed in: 1.13.0

    EPSS 40.7%

  • CVE-2021-411832021-10-26

    XSS in `*Text` options of the Datepicker widget

    Affected versions: < 1.13.0

    medium 6.1

    Fixed in: 1.13.0

    EPSS 8.5%

  • CVE-2021-41182exploit code exists2021-10-26

    XSS in the `altField` option of the Datepicker widget

    Affected versions: < 1.13.0

    medium 6.1

    Fixed in: 1.13.0

    EPSS 39.3%

  • CVE-2016-71032017-03-15

    Cross-site scripting (XSS) vulnerability in jQuery UI before 1.12.0 might allow remote attackers to inject arbitrary web script or HTML via

    Affected versions: < 1.12.0

    medium 6.1

    Fixed in: 1.12.0

    EPSS 29.1%

  • CVE-2012-66622014-11-24

    Cross-site scripting (XSS) vulnerability in the default content option in jquery.ui.tooltip.js in the Tooltip widget in jQuery UI before 1.1

    Affected versions: < 1.10.0 · >= 1.9.2, < 1.10.0

    medium 4.3

    Fixed in: 1.10.0

    EPSS 7.4%

  • CVE-2010-53122014-11-24

    Cross-site scripting (XSS) vulnerability in jquery.ui.dialog.js in the Dialog widget in jQuery UI before 1.10.0 allows remote attackers to i

    Affected versions: >= 1.7.0, < 1.10.0

    medium 6.1

    Fixed in: 1.10.0

    EPSS 18.3%

Sources and method

Ranges: GitHub Advisory Database (OSV npm export, daily) and Retire.js (Apache-2.0). Exploitation: CISA KEV, FIRST EPSS and exploit maturity from the Noroxi CVE database. Support dates: endoflife.date.

This page and the JavaScript library scan use the same matching rule: a row without bounds is not evidence, and versions are compared in one place. A record without a version range never counts as "affected" in the version check.

Data as of October 22, 2026.

Other libraries