# Outdated JavaScript libraries: find old jQuery and update it safely

> Which jQuery, jQuery UI, Bootstrap, Lodash or Moment.js versions your site runs, which ones have known vulnerabilities, and how to update them safely on WordPress and custom sites.

Updated 2026-09-26 · Security · HTML version: https://getreport.app/guides/outdated-javascript-libraries-jquery-vulnerabilities

The latest jQuery version is 4.0.0, released in January 2026; the last release of the 3.x line is 3.7.1. Plenty of sites still load jQuery 1.x or 2.x, or an old jQuery UI, Bootstrap or Lodash bundled inside a theme or plugin, and those versions have published vulnerabilities that scanners and security reviews flag. This guide is for site owners and developers who got that finding: you will see which libraries and versions your site really loads, what the advisories mean, and how to update without breaking the site. Allow an hour for a WordPress site, longer for custom code.

## Quick answer

- **Current versions (September 2026):** jQuery 4.0.0 (3.7.1 for the 3.x line), jQuery Migrate 4.0.2 (3.6.0 for jQuery 3), jQuery UI 1.14.2, Bootstrap 5.3.8.
- **jQuery before 3.5.0 has known cross-site scripting advisories** (CVE-2020-11022 and CVE-2020-11023, plus older ones). jQuery 3.5.0 and later, including 3.6.0 and 3.7.1, have no published advisories at the time of writing.
- **Find what you load:** run the [tech stack checker](https://getreport.app/tools/tech-stack), or type `jQuery.fn.jquery` in the browser console.
- **On WordPress,** core already ships jQuery 3.7.1 with jQuery Migrate 3.4.1. An old version almost always comes from a theme or plugin that loads its own copy: update it, replace it, or stop it loading its copy.
- **On custom sites,** upgrade with jQuery Migrate in development, fix the warnings it logs, then remove Migrate.
- **Libraries that are end-of-life** (AngularJS, Bootstrap 3 and 4, Moment.js for new work) get no more fixes: plan a replacement rather than waiting for a patch.

## What does "includes front-end JavaScript libraries with known security vulnerabilities" mean?

That sentence was the title of a Lighthouse audit, and many scanners still use the wording. It means a script your page loads is a library version for which a vulnerability has been published: someone has found a way to misuse it, it has an identifier such as CVE-2020-11022, and a fixed version usually exists.

It does **not** mean your site has been hacked, or even that the weakness can be exploited on your pages. Most jQuery advisories are cross-site scripting (XSS) problems that only apply when a page passes untrusted HTML (from a URL, a form or a third party) into certain jQuery functions. But you cannot easily prove your theme and every plugin never do that, attackers scan for old versions automatically, and security questionnaires, penetration tests and some cyber insurers flag them. Updating is usually cheaper than arguing.

### How advisories work

- A researcher reports a flaw to the maintainers, who release a fixed version.
- The flaw gets a **CVE** identifier and a description of the affected versions ("from 1.2 before 3.5.0").
- The **GitHub Advisory Database** (IDs starting GHSA) records the affected npm package and version ranges; the US **NVD** adds a CVSS severity score. The two sometimes rate the same flaw differently.
- **OSV.dev** collects these into one open, machine-readable database that scanners query by package name and version.

A scanner can only match versions it can read. If a library is loaded without a version in its file name or its code, a good scanner says "unknown version" instead of guessing.

## What is jQuery and is it still used?

jQuery is a JavaScript library from 2006 that made selecting elements, handling clicks, animating and sending AJAX requests work the same in every browser. It is still one of the most used libraries on the web: W3Techs has measured it on more than 70% of all websites for years, mostly because WordPress core, thousands of themes and plugins, and older site builders depend on it.

For new projects, modern browsers do most of what jQuery was for (`document.querySelector`, `fetch`, `classList`, CSS transitions), so developers rarely add it any more. But it is not dead: the project is maintained, 4.0 shipped in January 2026, and keeping an existing jQuery site on a current version is a perfectly good choice.

## What is the latest version of jQuery?

| Library | Latest | Notes |
| --- | --- | --- |
| jQuery | 4.0.0 (January 2026) | Drops Internet Explorer 10 and older, removes long-deprecated functions |
| jQuery 3.x | 3.7.1 (August 2023) | The version WordPress core ships |
| jQuery Migrate | 4.0.2 for jQuery 4, 3.6.0 for jQuery 3 | Restores removed functions and logs a warning for each use |
| jQuery UI | 1.14.2 (January 2026) | Also shipped by WordPress core |

jQuery 4 removes functions that were deprecated in 3.x, among them `jQuery.trim`, `jQuery.isArray`, `jQuery.parseJSON` and `jQuery.type`. Old code that calls them breaks without jQuery Migrate 4. For most sites the safe target today is jQuery 3.7.1; move to 4.0 when your own code and plugins are ready for it.

## How do I check which jQuery version my site uses?

**In the browser console** (F12 → Console) on any page of the site:

```js
jQuery.fn.jquery        // "3.7.1"
jQuery.migrateVersion   // "3.4.1", when jQuery Migrate is loaded
jQuery.ui && jQuery.ui.version   // "1.14.2", when jQuery UI is loaded
```

If the console says `jQuery is not defined`, the page does not load jQuery globally.

**In the page source** (Ctrl+U), search for `jquery`. The file name or the query string often carries the version, and so does the path, which tells you who loads it:

```html
<script src="https://getreport.app/wp-includes/js/jquery/jquery.min.js?ver=3.7.1"></script>
<script src="https://getreport.app/wp-content/plugins/old-slider/js/jquery-1.12.4.min.js"></script>
```

The first line is WordPress core's copy; the second is a plugin loading its own. That second line is the one to deal with.

**For other libraries**, the console has the same kind of property:

```js
_.VERSION                                  // Lodash
moment.version                             // Moment.js
angular.version.full                       // AngularJS
bootstrap.Tooltip.VERSION                  // Bootstrap 5
jQuery.fn.tooltip.Constructor.VERSION      // Bootstrap 3 and 4
```

## Which jQuery versions have known vulnerabilities?

The advisories for jQuery core, from the GitHub Advisory Database:

| Advisory | Affected versions | Fixed in | What it is |
| --- | --- | --- | --- |
| CVE-2012-6708 | before 1.9.0 | 1.9.0 | A selector string can be treated as HTML, allowing XSS |
| CVE-2015-9251 | before 3.0.0 | 3.0.0 | Cross-domain AJAX responses can be executed as script |
| CVE-2019-11358 | before 3.4.0 | 3.4.0 | Prototype pollution through `jQuery.extend(true, …)` |
| CVE-2020-11022 | 1.2 up to 3.4.1 | 3.5.0 | HTML passed to `.html()`, `.append()` and similar can run script, even after sanitising |
| CVE-2020-11023 | 1.0.3 up to 3.4.1 | 3.5.0 | The same, through `<option>` elements |

So every 1.x and 2.x release and 3.x before 3.5.0 has at least three advisories, all rated moderate. **jQuery 3.5.0 and later, including 3.6.0 and 3.7.1, have no published advisories** at the time of writing. If a scanner flags 3.6.0 or 3.7.1, check which advisory it names: it is usually about jQuery UI, jQuery Migrate or a plugin, not jQuery itself.

## What about jQuery Migrate and jQuery UI?

**jQuery Migrate** is a helper, not a feature library. Load it after jQuery and it puts back functions newer jQuery removed, and logs a `JQMIGRATE:` warning in the console each time old code uses one. It exists to make upgrades safe: you upgrade jQuery, keep the site working with Migrate, fix the warnings, then remove Migrate. There are no published advisories for jQuery Migrate 3.4.1, the version WordPress loads, but Migrate also restores old behaviour, so the goal is to not need it.

**jQuery UI** (date pickers, dialogs, sortable lists) has its own advisories:

- CVE-2016-7103, XSS through the dialog's `closeText` option, fixed in 1.12.0.
- CVE-2021-41182, 41183 and 41184, XSS through date picker text options and `.position()`, fixed in 1.13.0.
- CVE-2022-31160, XSS in the checkbox and radio widget labels, fixed in 1.13.2.

jQuery UI 1.12.1, still common in older themes, is affected by four of these. Update to 1.14.2, which also works with jQuery 3 and 4.

## How do I scan my site for vulnerable JavaScript libraries?

> **Free tool:** [CMS detector and website technology checker](https://getreport.app/tools/tech-stack): Free CMS detector: see what any website is built with, from CMS and framework to JavaScript libraries, CDN and server, plus known vulnerabilities per version.

The tech stack checker loads the page in Chromium, so libraries added by scripts count too. It reads versions from the library itself where the library exposes one (jQuery, Lodash, Moment.js, AngularJS, Bootstrap 5) or from a versioned script URL, and matches each library and version against OSV.dev, which includes the GitHub advisories. Each advisory links to its source, with the version that fixes it. A library whose version it cannot read is listed without a version, and no advisories are claimed for it.

> **Check: No known security holes in the JavaScript libraries we could identify.** Old library versions have published attacks that anyone can copy, most often cross-site scripting. Attackers scan for them automatically, and security reviews and some insurers flag them.
>
> 1. Update each library to at least the fixed version in the technical detail; on WordPress, update the theme and plugins that bundle it.
> 2. For jQuery on WordPress, remove plugins that load their own old copy instead of the one WordPress ships.
> 3. If a library is no longer needed, remove it; Moment.js and AngularJS are end-of-life, so plan a replacement.

The finding is a warning when the worst advisory is moderate or low, and a failure when any is rated high or critical. The technical detail lists each library with its advisory count and the lowest version that fixes all of them.

> **Check: Technology stack.** Knowing the CMS, framework, CDN and analytics behind a page helps you and your developer find the right settings for the fixes in this report.
>
> 1. Nothing to fix; use this list to find the right settings panel for the other findings.

The same tool reports the CMS version and, on WordPress, plugins that are closed or abandoned, because that is where old libraries usually come from:

> **Check: CMS version.** Old CMS versions have published security holes that bots scan for automatically, and the generator tag advertises the exact version to them.
>
> 1. Back up the site, then update the CMS from its admin dashboard; update plugins and themes at the same time.
> 2. Remove the generator tag (WordPress: remove_action('wp_head', 'wp_generator') in functions.php).

> **Check: Every detected plugin has a recent update.** A plugin nobody maintains will not get security fixes and eventually breaks with a WordPress update. Two years without a release is the usual sign that it is abandoned.
>
> 1. Look for a maintained alternative with the same feature and replace the plugin; test on staging first.
> 2. If it is essential and small, consider paying a developer to take it over.

For a code base rather than a live page, **Retire.js** (a command-line tool and browser extension) scans JavaScript files against its own list of vulnerable versions, and `npm audit` checks everything in `package.json`, including libraries that end up in your bundle.

## How do I update jQuery safely on WordPress and other CMSs?

### WordPress: find who loads the old copy

WordPress core ships jQuery 3.7.1, jQuery Migrate 3.4.1 and jQuery UI 1.14.2, and updates them with core. If the report shows jQuery 1.x or 2.x, a theme or plugin is replacing or adding to core's copy.

1. **Find the source.** In the page source, the path of the old file names the plugin or theme (`/wp-content/plugins/NAME/` or `/wp-content/themes/NAME/`). The free **Query Monitor** plugin's Scripts panel lists every script with its handle, version and the component that enqueued it.
2. **Update that plugin or theme.** Many fixed this years ago; the site just never got the update. Take a backup first.
3. **Remove "jQuery replacement" plugins and snippets.** Plugins that load jQuery from a CDN or "fix" jQuery for old themes often pin an ancient version. So does theme code like this, in `functions.php`:

```php
// Replaces WordPress's jQuery with an old copy: delete this
wp_deregister_script( 'jquery' );
wp_register_script( 'jquery', 'https://ajax.googleapis.com/ajax/libs/jquery/1.12.4/jquery.min.js', array(), '1.12.4' );
```

4. **Test with jQuery Migrate's warnings on.** Add `define( 'SCRIPT_DEBUG', true );` to `wp-config.php` on a staging copy. WordPress then loads the unminified jQuery Migrate, and the console shows a `JQMIGRATE:` line for every outdated call, with the file that made it. Click through the site, fix or report what shows up, then remove the line.
5. **Optionally drop jQuery Migrate from the front end** once the console is clean, with a small plugin or a snippet in a child theme:

```php
add_action( 'wp_default_scripts', function ( $scripts ) {
    if ( ! is_admin() && isset( $scripts->registered['jquery'] ) ) {
        $scripts->registered['jquery']->deps = array_diff(
            $scripts->registered['jquery']->deps,
            array( 'jquery-migrate' )
        );
    }
} );
```

Never edit core's files in `wp-includes` or replace them by hand; the next update overwrites them, and a mismatched version can break the admin screens.

### Joomla, Drupal and other CMSs

Joomla and Drupal also ship jQuery with core (Drupal only where a module asks for it), so the fix is the same: update core, then find the extension or theme that loads an older copy, and update or replace it. [Outdated CMS versions](https://getreport.app/guides/outdated-cms-versions-reading-the-generator-tag) has a safe update routine for core itself.

### Custom sites and apps

1. **Find every copy.** Search the code base for `jquery` in script tags, bundles and `package.json`. Sites often load one copy from a CDN and bundle another.
2. **Add jQuery Migrate** matching the target (Migrate 3 for jQuery 3.7.1, Migrate 4 for jQuery 4.0) in development, with the unminified build so warnings appear.
3. **Update jQuery**, reload every template and interactive feature, and fix each `JQMIGRATE` warning. Code written for jQuery older than 1.9 may need jQuery 1.12 with Migrate 1.4.1 as a first step, then Migrate 3 for the move to 3.x.
4. **Remove Migrate** once there are no warnings, and update plugins that depend on old jQuery (sliders, date pickers, validation) at the same time.
5. **If you load from a CDN,** change the version in the URL and update the Subresource Integrity hash with it; [Subresource Integrity for third-party scripts](https://getreport.app/guides/subresource-integrity-for-third-party-scripts) explains how.

## What if a plugin bundles an old library?

This is the most common case on WordPress, and the options in order of preference:

1. **Update the plugin.** Check its changelog for the library update.
2. **Ask the developer.** Open a support ticket with the library, the version and the advisory (for example "jQuery UI 1.12.1, CVE-2022-31160, fixed in 1.13.2"). A concrete advisory gets a faster answer than "your plugin is insecure".
3. **Replace it** if it has not been updated in two years or has been closed; [abandoned and closed plugins](https://getreport.app/guides/abandoned-and-closed-plugins-how-to-find-replacements) shows how to choose a successor.
4. **Limit where it loads.** If the plugin is only needed on one page (a booking form, a gallery), an asset manager setting or a conditional dequeue keeps its old library off every other page. That shrinks the exposure, but the pages it still loads on are still flagged.
5. **Do not patch the plugin's files.** The next update overwrites your change, and replacing a bundled library with a newer one you did not test can break the plugin silently.

> **Check: No detected plugin has been closed on wordpress.org.** wordpress.org closes plugins for unfixed security issues or guideline violations. A closed plugin gets no updates and often has a known vulnerability.
>
> 1. Replace the plugin now; the reason shown by wordpress.org tells you how urgent it is.
> 2. Until then, keep the site behind a firewall plugin and check the vulnerability databases for the plugin name.

## Other libraries to watch

- **Bootstrap:** 3.x before 3.4.1 and 4.x before 4.3.1 have XSS advisories in the tooltip, popover, collapse and scrollspy options (CVE-2018-14040, 14041, 14042 and CVE-2019-8331). Bootstrap 3 and 4 are end-of-life, so newer advisories get no fix in those lines; the long-term answer is Bootstrap 5.
- **Lodash:** versions before 4.17.21 have prototype pollution and command injection advisories (among them CVE-2019-10744 and CVE-2021-23337). Update to the latest 4.x.
- **Moment.js:** before 2.29.4 it has a regular-expression denial of service (CVE-2022-31129); the project has been in maintenance mode since 2020 and recommends Luxon, Day.js, date-fns or the built-in `Intl` for new code.
- **AngularJS (1.x):** support ended on 31 December 2021. Advisories published since then have no official fix, so an AngularJS site needs a migration plan.
- **Handlebars, Underscore.js and old framework versions** (React, Vue, Next.js) are checked the same way when their version is readable.

## Verify

- Run the [tech stack checker](https://getreport.app/tools/tech-stack) again. The finding should read "No known security holes in the JavaScript libraries we could identify", with the versions it checked.
- In the console, `jQuery.fn.jquery` shows the new version on the home page and on the pages that load the updated plugin.
- The page source shows one jQuery file, not two.
- With `SCRIPT_DEBUG` on in staging, the console shows no `JQMIGRATE` warnings when you use the site's menus, forms, sliders and checkout.

## Common mistakes

- **Loading two copies of jQuery.** Core's and a plugin's. The second one replaces the first and any plugins bound to it lose their functions. Keep one, the current one.
- **Updating jQuery without Migrate first.** Old code breaks silently: a menu that no longer opens, a checkout button that does nothing. Always upgrade with Migrate's warnings visible.
- **Trusting "no vulnerabilities" when no version was read.** A library without a readable version is unknown, not safe.
- **Treating the finding as proof of a hack.** It is a known weakness, not an intrusion. If you suspect an intrusion, [is my website hacked?](https://getreport.app/guides/is-my-website-hacked) covers what to look for.
- **Pinning an old version to fix one broken plugin.** It re-opens every advisory for every page. Fix or replace the plugin instead.

## Questions people ask

### What is jQuery?

jQuery is a free JavaScript library, first released in 2006, that makes it easier to select page elements, respond to clicks, animate content and load data without reloading the page. It smoothed over differences between browsers. It still runs on most websites, largely because WordPress and many themes and plugins depend on it. The current version is 4.0.0.

### Are there vulnerabilities in jQuery 3.6.0?

No published advisories affect jQuery 3.6.0 itself at the time of writing. The known jQuery XSS advisories (CVE-2020-11022 and CVE-2020-11023) were fixed in 3.5.0. If a scanner flags 3.6.0, check the advisory it names; it usually concerns jQuery UI, jQuery Migrate or a plugin. Updating to 3.7.1 is still worthwhile for its bug fixes.

### Is jQuery 3.7.1 vulnerable?

No. jQuery 3.7.1, the last 3.x release and the version WordPress core ships, has no published security advisories at the time of writing. It is a safe version to run. jQuery 4.0.0 is newer but removes deprecated functions, so move to it only after testing your code and plugins with jQuery Migrate 4.

### Is jQuery still used?

Yes. W3Techs has measured jQuery on more than 70% of all websites for years, because WordPress core and many themes and plugins rely on it, and the project is still maintained: jQuery 4.0 was released in January 2026. New projects rarely add it, since modern browsers cover most of what it did, but keeping an existing site on a current version is fine.

### What is the latest version of jQuery?

jQuery 4.0.0, released in January 2026. The last 3.x release is 3.7.1 from August 2023, which WordPress core still ships. jQuery 4 drops support for Internet Explorer 10 and older and removes functions deprecated in 3.x, so most sites should run 3.7.1 until their code and plugins are tested with 4.0.

### How do I check which jQuery version a site uses?

Open the browser console on the site (F12, then Console) and type `jQuery.fn.jquery`; it returns the version, such as "3.7.1". You can also search the page source for "jquery" and read the version from the file name or `?ver=` parameter. A free tech stack checker lists jQuery and other libraries with their versions and known advisories.

### How do I fix jQuery vulnerabilities?

Update to jQuery 3.5.0 or later, ideally 3.7.1. On WordPress, core already ships 3.7.1, so find the theme or plugin that loads an older copy and update, replace or stop it. On custom sites, add jQuery Migrate in development, update jQuery, fix the warnings Migrate logs, then remove Migrate and check again with a scanner.

### What are JavaScript library vulnerabilities?

They are published flaws in specific versions of libraries such as jQuery, Bootstrap or Lodash, each with an advisory ID like CVE-2020-11022 and a fixed version. Most are cross-site scripting or prototype pollution issues that attackers can use when a page handles untrusted input. Scanners match the versions your pages load against databases such as OSV.dev and the GitHub Advisory Database.