cyfenced.com →

[ CVE-2020-11023 · Published 29 Apr 2020 ]

JQuery Cross-Site Scripting (XSS) Vulnerability

Exploited · CISA KEV CVSS 6.1 EPSS 85%1 agency advisoryFix available

[ Why it matters ]Priority signals

  • Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2025-01-23
  • EPSS: 85% chance of exploitation in the next 30 days (higher than 100% of CVEs)

[ Description ]Official description

In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

CISA: JQuery contains a persistent cross-site scripting (XSS) vulnerability. When passing maliciously formed, untrusted input enclosed in HTML tags, JQuery's DOM manipulators can execute untrusted code in the context of the user's browser.

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 13 Feb 2025): Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

[ Advisories ]Government CERT advisories

  • CERT-FRCERTFR-2026-AVI-1291

    Multiple vulnerabilities in IBM products Translated from French

    Multiple vulnerabilities have been discovered in IBM products. Some of them allow an attacker to cause remote arbitrary code execution, privilege escalation and remote denial of service.

    CVE-2026-49978CVE-2025-27895CVE-2026-59651+195 more CVEs

[ References ]References