https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2020-7656.htmlhttps://patchthecve.com/cve/CVE-2020-7656.htmlWed, 17 Jun 2026 03:25:12 +0000MEDIUM 6.1: jquery prior to 1.9.0 allows Cross-site Scripting attacks via the load method. The load method fails to recognize and remove "<script>" HTML tags that contain a whitespace character, i.e: "</script >", which results in the enclosed script logic to be executed.https://patchthecve.com/cve/CVE-2020-11022.htmlhttps://patchthecve.com/cve/CVE-2020-11022.htmlWed, 17 Jun 2026 02:48:52 +0000MEDIUM 6.9: In jQuery starting with 1.12.0 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.https://patchthecve.com/cve/CVE-2020-11023.htmlhttps://patchthecve.com/cve/CVE-2020-11023.htmlWed, 17 Jun 2026 02:48:52 +0000MEDIUM 6.9: In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jhttps://patchthecve.com/cve/CVE-2018-18405.htmlhttps://patchthecve.com/cve/CVE-2018-18405.htmlWed, 17 Jun 2026 01:47:09 +0000MEDIUM 6.1: jQuery v2.2.2 allows XSS via a crafted onerror attribute of an IMG element. NOTE: this vulnerability has been reported to be spam entryhttps://patchthecve.com/cve/CVE-2019-11358.htmlhttps://patchthecve.com/cve/CVE-2019-11358.htmlWed, 17 Jun 2026 02:12:46 +0000MEDIUM 6.1: jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Object.prototype.