How to find and update vulnerable JavaScript libraries
An old jQuery, Bootstrap or Lodash on your pages has published attacks anyone can copy. Check which versions load, update to the fixed release and remove copies plugins bundle on their own.
Step by step, with screenshots: Outdated JavaScript libraries: find old jQuery and update it safely →
Check your own site
Runs this check and the other 192, free, in about 45 seconds.
Or run only this check with the free Tech stack & CMS detector.
What it is
A vulnerable JavaScript library is an old version of a shared library, such as jQuery, Bootstrap, Lodash, Moment.js or AngularJS, with security holes that have been publicly disclosed and given CVE numbers. When your pages load that version, the published attack works against your site too.
Most of these flaws allow cross-site scripting, where an attacker gets their own script to run in your visitors' browsers and steal sessions or form data. Automated scanners look for them, and security reviews and insurers flag them. getReport detects the library versions your page loads and matches them against known vulnerabilities. A page is OK when every library is on a version without known issues, for jQuery 3.5.0 or later.
What a passing site looks like
- No known security holes in the JavaScript libraries we could identifyfail · −5 ptseffort M
Vulnerable JavaScript libraries
Why it matters. Old library versions have published attacks that anyone can copy, most often cross-site scripting. Attackers scan for them automatically, and security reviews and some insurers flag them.
- Update each library to at least the fixed version in the technical detail; on WordPress, update the theme and plugins that bundle it.
- For jQuery on WordPress, remove plugins that load their own old copy instead of the one WordPress ships.
- If a library is no longer needed, remove it; Moment.js and AngularJS are end-of-life, so plan a replacement.
Questions people ask
What does "use of JavaScript library with known vulnerability" mean?
It means a scanner found a library version on your page that appears in a public vulnerability database. It does not prove your site has been attacked, or even that the vulnerable function is used, but the risk is real because working exploits are published. Updating the library, or removing it if nothing needs it, clears the finding.
How do I scan my site for vulnerable JavaScript libraries?
A getReport run lists the libraries it detects with their versions and known issues. For your own code, npm audit or a dependency scanner in your repository checks packages before they ship. Plugins, themes and third-party widgets often bundle their own copies, so check what the live page actually loads, not only your package file.
Which jQuery versions have known vulnerabilities?
All versions before 3.5.0 have published cross-site scripting issues, including CVE-2020-11022 and CVE-2020-11023 in the functions that handle HTML, and versions before 3.4.0 also have a prototype pollution flaw. The jQuery Migrate plugin helps when upgrading old code. WordPress core ships a current jQuery, so an old copy usually comes from a theme or plugin bundling its own.