Old jQuery is on CISA’s exploited list. Here’s how to check your website.

What the flaw is

jQuery is a small JavaScript library that makes menus, sliders, pop-ups and forms work. In versions before 3.5.0, passing HTML that contains option elements to jQuery’s page-building functions (such as .html() and .append()) can run code hidden inside it, even if the HTML was cleaned first. An attacker who can get crafted text into a page that uses those functions can run their own script in a visitor’s browser: stealing a session, rewriting a form, or redirecting a payment.

Whether a particular site can actually be attacked this way depends on what its own code does with jQuery. What isn’t in doubt is that CISA has evidence it’s being used in real attacks, and that the fix has been available since 2020.

Who still runs it

• Current WordPress is fine. WordPress itself has shipped jQuery 3.5 or newer since version 5.6 in December 2020. The risk is themes and plugins that load their own older copy, and sites that haven’t updated WordPress in years.
• Adobe Muse sites. Adobe stopped supporting Muse in 2020, and Muse exports load jQuery 1.8.3 from 2012. Several local sites we reviewed in October 2026 were built this way. A Muse site can’t be updated from inside Muse; it needs a rebuild.
• Old templates and hand-built sites that link a fixed jQuery version from a CDN and were never touched again.

Check your site in a minute

1. Run the free checkOur free website check reads the jQuery version your page loads and flags anything before 3.5.0.
2. Or look yourselfOpen your site in Chrome, right-click, choose View Page Source and search for “jquery”. The version is usually in the file name (jquery-1.8.3.min.js) or after ?ver= in the address.
3. Or ask the browserOn your site, open Chrome’s console (F12, then Console) and type jQuery.fn.jquery. It prints the version.

What to do

• WordPress: update WordPress, every plugin and the theme. If a theme still loads its own old jQuery, it’s either abandoned or needs replacing.
• A site you can edit: replace the old file with a current jQuery 3.x release and test every menu, slider and form, because plugins written for jQuery 1.x can break.
• Adobe Muse, or a site nobody can edit anymore: rebuild it. There’s no update path, and a rebuild is the point where the site gets phones, speed and security right at the same time.

Sources

• GitHub Security Advisory GHSA-jpcq-cgw6-v4j6 (CVE-2020-11023)
• jQuery: jQuery 3.5.0 released (April 10, 2020)
• CISA Known Exploited Vulnerabilities catalog
• Our vulnerability database: CVE-2020-11023