Outdated JavaScript libraries: find old jQuery and update it safely

The latest jQuery version is 4.0.0, released in January 2026; the last release of the 3.x line is 3.7.1. Plenty of sites still load jQuery 1.x or 2.x, or an old jQuery UI, Bootstrap or Lodash bundled inside a theme or plugin, and those versions have published vulnerabilities that scanners and security reviews flag. This guide is for site owners and developers who got that finding: you will see which libraries and versions your site really loads, what the advisories mean, and how to update without breaking the site. Allow an hour for a WordPress site, longer for custom code.

Quick answer

• Current versions (September 2026): jQuery 4.0.0 (3.7.1 for the 3.x line), jQuery Migrate 4.0.2 (3.6.0 for jQuery 3), jQuery UI 1.14.2, Bootstrap 5.3.8.
• jQuery before 3.5.0 has known cross-site scripting advisories (CVE-2020-11022 and CVE-2020-11023, plus older ones). jQuery 3.5.0 and later, including 3.6.0 and 3.7.1, have no published advisories at the time of writing.
• Find what you load: run the tech stack checker, or type jQuery.fn.jquery in the browser console.
• On WordPress, core already ships jQuery 3.7.1 with jQuery Migrate 3.4.1. An old version almost always comes from a theme or plugin that loads its own copy: update it, replace it, or stop it loading its copy.
• On custom sites, upgrade with jQuery Migrate in development, fix the warnings it logs, then remove Migrate.
• Libraries that are end-of-life (AngularJS, Bootstrap 3 and 4, Moment.js for new work) get no more fixes: plan a replacement rather than waiting for a patch.

What does "includes front-end JavaScript libraries with known security vulnerabilities" mean?

That sentence was the title of a Lighthouse audit, and many scanners still use the wording. It means a script your page loads is a library version for which a vulnerability has been published: someone has found a way to misuse it, it has an identifier such as CVE-2020-11022, and a fixed version usually exists.

It does not mean your site has been hacked, or even that the weakness can be exploited on your pages. Most jQuery advisories are cross-site scripting (XSS) problems that only apply when a page passes untrusted HTML (from a URL, a form or a third party) into certain jQuery functions. But you cannot easily prove your theme and every plugin never do that, attackers scan for old versions automatically, and security questionnaires, penetration tests and some cyber insurers flag them. Updating is usually cheaper than arguing.

How advisories work

• A researcher reports a flaw to the maintainers, who release a fixed version.
• The flaw gets a CVE identifier and a description of the affected versions ("from 1.2 before 3.5.0").
• The GitHub Advisory Database (IDs starting GHSA) records the affected npm package and version ranges; the US NVD adds a CVSS severity score. The two sometimes rate the same flaw differently.
• OSV.dev collects these into one open, machine-readable database that scanners query by package name and version.

A scanner can only match versions it can read. If a library is loaded without a version in its file name or its code, a good scanner says "unknown version" instead of guessing.

What is jQuery and is it still used?

jQuery is a JavaScript library from 2006 that made selecting elements, handling clicks, animating and sending AJAX requests work the same in every browser. It is still one of the most used libraries on the web: W3Techs has measured it on more than 70% of all websites for years, mostly because WordPress core, thousands of themes and plugins, and older site builders depend on it.

For new projects, modern browsers do most of what jQuery was for (document.querySelector, fetch, classList, CSS transitions), so developers rarely add it any more. But it is not dead: the project is maintained, 4.0 shipped in January 2026, and keeping an existing jQuery site on a current version is a perfectly good choice.

What is the latest version of jQuery?

jQuery 4 removes functions that were deprecated in 3.x, among them jQuery.trim, jQuery.isArray, jQuery.parseJSON and jQuery.type. Old code that calls them breaks without jQuery Migrate 4. For most sites the safe target today is jQuery 3.7.1; move to 4.0 when your own code and plugins are ready for it.

How do I check which jQuery version my site uses?

In the browser console (F12 → Console) on any page of the site:

jQuery.fn.jquery        // "3.7.1"
jQuery.migrateVersion   // "3.4.1", when jQuery Migrate is loaded
jQuery.ui && jQuery.ui.version   // "1.14.2", when jQuery UI is loaded

If the console says jQuery is not defined, the page does not load jQuery globally.

In the page source (Ctrl+U), search for jquery. The file name or the query string often carries the version, and so does the path, which tells you who loads it:

<script src="/wp-includes/js/jquery/jquery.min.js?ver=3.7.1"></script>
<script src="/wp-content/plugins/old-slider/js/jquery-1.12.4.min.js"></script>

The first line is WordPress core's copy; the second is a plugin loading its own. That second line is the one to deal with.

For other libraries, the console has the same kind of property:

_.VERSION                                  // Lodash
moment.version                             // Moment.js
angular.version.full                       // AngularJS
bootstrap.Tooltip.VERSION                  // Bootstrap 5
jQuery.fn.tooltip.Constructor.VERSION      // Bootstrap 3 and 4

Which jQuery versions have known vulnerabilities?

The advisories for jQuery core, from the GitHub Advisory Database:

So every 1.x and 2.x release and 3.x before 3.5.0 has at least three advisories, all rated moderate. jQuery 3.5.0 and later, including 3.6.0 and 3.7.1, have no published advisories at the time of writing. If a scanner flags 3.6.0 or 3.7.1, check which advisory it names: it is usually about jQuery UI, jQuery Migrate or a plugin, not jQuery itself.

What about jQuery Migrate and jQuery UI?

jQuery Migrate is a helper, not a feature library. Load it after jQuery and it puts back functions newer jQuery removed, and logs a JQMIGRATE: warning in the console each time old code uses one. It exists to make upgrades safe: you upgrade jQuery, keep the site working with Migrate, fix the warnings, then remove Migrate. There are no published advisories for jQuery Migrate 3.4.1, the version WordPress loads, but Migrate also restores old behaviour, so the goal is to not need it.

jQuery UI (date pickers, dialogs, sortable lists) has its own advisories:

• CVE-2016-7103, XSS through the dialog's closeText option, fixed in 1.12.0.
• CVE-2021-41182, 41183 and 41184, XSS through date picker text options and .position(), fixed in 1.13.0.
• CVE-2022-31160, XSS in the checkbox and radio widget labels, fixed in 1.13.2.

jQuery UI 1.12.1, still common in older themes, is affected by four of these. Update to 1.14.2, which also works with jQuery 3 and 4.

How do I scan my site for vulnerable JavaScript libraries?

The tech stack checker loads the page in Chromium, so libraries added by scripts count too. It reads versions from the library itself where the library exposes one (jQuery, Lodash, Moment.js, AngularJS, Bootstrap 5) or from a versioned script URL, and matches each library and version against OSV.dev, which includes the GitHub advisories. Each advisory links to its source, with the version that fixes it. A library whose version it cannot read is listed without a version, and no advisories are claimed for it.

The finding is a warning when the worst advisory is moderate or low, and a failure when any is rated high or critical. The technical detail lists each library with its advisory count and the lowest version that fixes all of them.

The same tool reports the CMS version and, on WordPress, plugins that are closed or abandoned, because that is where old libraries usually come from:

For a code base rather than a live page, Retire.js (a command-line tool and browser extension) scans JavaScript files against its own list of vulnerable versions, and npm audit checks everything in package.json, including libraries that end up in your bundle.

How do I update jQuery safely on WordPress and other CMSs?

WordPress: find who loads the old copy

WordPress core ships jQuery 3.7.1, jQuery Migrate 3.4.1 and jQuery UI 1.14.2, and updates them with core. If the report shows jQuery 1.x or 2.x, a theme or plugin is replacing or adding to core's copy.

1. Find the source. In the page source, the path of the old file names the plugin or theme (/wp-content/plugins/NAME/ or /wp-content/themes/NAME/). The free Query Monitor plugin's Scripts panel lists every script with its handle, version and the component that enqueued it.
2. Update that plugin or theme. Many fixed this years ago; the site just never got the update. Take a backup first.
3. Remove "jQuery replacement" plugins and snippets. Plugins that load jQuery from a CDN or "fix" jQuery for old themes often pin an ancient version. So does theme code like this, in functions.php:

// Replaces WordPress's jQuery with an old copy: delete this
wp_deregister_script( 'jquery' );
wp_register_script( 'jquery', 'https://ajax.googleapis.com/ajax/libs/jquery/1.12.4/jquery.min.js', array(), '1.12.4' );

4. Test with jQuery Migrate's warnings on. Add define( 'SCRIPT_DEBUG', true ); to wp-config.php on a staging copy. WordPress then loads the unminified jQuery Migrate, and the console shows a JQMIGRATE: line for every outdated call, with the file that made it. Click through the site, fix or report what shows up, then remove the line.
5. Optionally drop jQuery Migrate from the front end once the console is clean, with a small plugin or a snippet in a child theme:

add_action( 'wp_default_scripts', function ( $scripts ) {
    if ( ! is_admin() && isset( $scripts->registered['jquery'] ) ) {
        $scripts->registered['jquery']->deps = array_diff(
            $scripts->registered['jquery']->deps,
            array( 'jquery-migrate' )
        );
    }
} );

Never edit core's files in wp-includes or replace them by hand; the next update overwrites them, and a mismatched version can break the admin screens.

Joomla, Drupal and other CMSs

Joomla and Drupal also ship jQuery with core (Drupal only where a module asks for it), so the fix is the same: update core, then find the extension or theme that loads an older copy, and update or replace it. Outdated CMS versions has a safe update routine for core itself.

Custom sites and apps

1. Find every copy. Search the code base for jquery in script tags, bundles and package.json. Sites often load one copy from a CDN and bundle another.
2. Add jQuery Migrate matching the target (Migrate 3 for jQuery 3.7.1, Migrate 4 for jQuery 4.0) in development, with the unminified build so warnings appear.
3. Update jQuery, reload every template and interactive feature, and fix each JQMIGRATE warning. Code written for jQuery older than 1.9 may need jQuery 1.12 with Migrate 1.4.1 as a first step, then Migrate 3 for the move to 3.x.
4. Remove Migrate once there are no warnings, and update plugins that depend on old jQuery (sliders, date pickers, validation) at the same time.
5. If you load from a CDN, change the version in the URL and update the Subresource Integrity hash with it; Subresource Integrity for third-party scripts explains how.

What if a plugin bundles an old library?

This is the most common case on WordPress, and the options in order of preference:

1. Update the plugin. Check its changelog for the library update.
2. Ask the developer. Open a support ticket with the library, the version and the advisory (for example "jQuery UI 1.12.1, CVE-2022-31160, fixed in 1.13.2"). A concrete advisory gets a faster answer than "your plugin is insecure".
3. Replace it if it has not been updated in two years or has been closed; abandoned and closed plugins shows how to choose a successor.
4. Limit where it loads. If the plugin is only needed on one page (a booking form, a gallery), an asset manager setting or a conditional dequeue keeps its old library off every other page. That shrinks the exposure, but the pages it still loads on are still flagged.
5. Do not patch the plugin's files. The next update overwrites your change, and replacing a bundled library with a newer one you did not test can break the plugin silently.

Other libraries to watch

• Bootstrap: 3.x before 3.4.1 and 4.x before 4.3.1 have XSS advisories in the tooltip, popover, collapse and scrollspy options (CVE-2018-14040, 14041, 14042 and CVE-2019-8331). Bootstrap 3 and 4 are end-of-life, so newer advisories get no fix in those lines; the long-term answer is Bootstrap 5.
• Lodash: versions before 4.17.21 have prototype pollution and command injection advisories (among them CVE-2019-10744 and CVE-2021-23337). Update to the latest 4.x.
• Moment.js: before 2.29.4 it has a regular-expression denial of service (CVE-2022-31129); the project has been in maintenance mode since 2020 and recommends Luxon, Day.js, date-fns or the built-in Intl for new code.
• AngularJS (1.x): support ended on 31 December 2021. Advisories published since then have no official fix, so an AngularJS site needs a migration plan.
• Handlebars, Underscore.js and old framework versions (React, Vue, Next.js) are checked the same way when their version is readable.

Verify

• Run the tech stack checker again. The finding should read "No known security holes in the JavaScript libraries we could identify", with the versions it checked.
• In the console, jQuery.fn.jquery shows the new version on the home page and on the pages that load the updated plugin.
• The page source shows one jQuery file, not two.
• With SCRIPT_DEBUG on in staging, the console shows no JQMIGRATE warnings when you use the site's menus, forms, sliders and checkout.

Common mistakes

• Loading two copies of jQuery. Core's and a plugin's. The second one replaces the first and any plugins bound to it lose their functions. Keep one, the current one.
• Updating jQuery without Migrate first. Old code breaks silently: a menu that no longer opens, a checkout button that does nothing. Always upgrade with Migrate's warnings visible.
• Trusting "no vulnerabilities" when no version was read. A library without a readable version is unknown, not safe.
• Treating the finding as proof of a hack. It is a known weakness, not an intrusion. If you suspect an intrusion, is my website hacked? covers what to look for.
• Pinning an old version to fix one broken plugin. It re-opens every advisory for every page. Fix or replace the plugin instead.

Questions people ask

What is jQuery?

jQuery is a free JavaScript library, first released in 2006, that makes it easier to select page elements, respond to clicks, animate content and load data without reloading the page. It smoothed over differences between browsers. It still runs on most websites, largely because WordPress and many themes and plugins depend on it. The current version is 4.0.0.

Are there vulnerabilities in jQuery 3.6.0?

No published advisories affect jQuery 3.6.0 itself at the time of writing. The known jQuery XSS advisories (CVE-2020-11022 and CVE-2020-11023) were fixed in 3.5.0. If a scanner flags 3.6.0, check the advisory it names; it usually concerns jQuery UI, jQuery Migrate or a plugin. Updating to 3.7.1 is still worthwhile for its bug fixes.

Is jQuery 3.7.1 vulnerable?

No. jQuery 3.7.1, the last 3.x release and the version WordPress core ships, has no published security advisories at the time of writing. It is a safe version to run. jQuery 4.0.0 is newer but removes deprecated functions, so move to it only after testing your code and plugins with jQuery Migrate 4.

Is jQuery still used?

Yes. W3Techs has measured jQuery on more than 70% of all websites for years, because WordPress core and many themes and plugins rely on it, and the project is still maintained: jQuery 4.0 was released in January 2026. New projects rarely add it, since modern browsers cover most of what it did, but keeping an existing site on a current version is fine.

What is the latest version of jQuery?

jQuery 4.0.0, released in January 2026. The last 3.x release is 3.7.1 from August 2023, which WordPress core still ships. jQuery 4 drops support for Internet Explorer 10 and older and removes functions deprecated in 3.x, so most sites should run 3.7.1 until their code and plugins are tested with 4.0.

How do I check which jQuery version a site uses?

Open the browser console on the site (F12, then Console) and type jQuery.fn.jquery; it returns the version, such as "3.7.1". You can also search the page source for "jquery" and read the version from the file name or ?ver= parameter. A free tech stack checker lists jQuery and other libraries with their versions and known advisories.

How do I fix jQuery vulnerabilities?

Update to jQuery 3.5.0 or later, ideally 3.7.1. On WordPress, core already ships 3.7.1, so find the theme or plugin that loads an older copy and update, replace or stop it. On custom sites, add jQuery Migrate in development, update jQuery, fix the warnings Migrate logs, then remove Migrate and check again with a scanner.

What are JavaScript library vulnerabilities?

They are published flaws in specific versions of libraries such as jQuery, Bootstrap or Lodash, each with an advisory ID like CVE-2020-11022 and a fixed version. Most are cross-site scripting or prototype pollution issues that attackers can use when a page handles untrusted input. Scanners match the versions your pages load against databases such as OSV.dev and the GitHub Advisory Database.