Skip to main content
cve.nowby Sazabi
← Maven
MavenPackage

org.webjars.npm:jquery-ui

7 known vulnerabilities (4 medium), with the versions each affects and the releases that fix them.

Latest release
1.14.2 (Feb 24, 2026): no advisory affects it
Newest unaffected release
1.14.2 (Feb 24, 2026), the latest release
Advisories
7 · 4 medium
Dependents
28
Releases
14 since 1.10.4 (Aug 18, 2016)
Registry
Maven Central
Releases read
Nov 8, 2026

Version timeline

  • CVE-2022-31160
    Affects 1.10.4 to 1.13.1 (1.13.2 is outside it)
  • CVE-2021-41184
    Affects 1.10.4 to 1.13.0-rc.3 (1.13.0 is outside it)
  • CVE-2021-41183
    Affects 1.10.4 to 1.13.0-rc.3 (1.13.0 is outside it)
  • CVE-2021-41182
    Affects 1.10.4 to 1.13.0-rc.3 (1.13.0 is outside it)
  • CVE-2016-7103
    Affects 1.10.4 to 1.12.0-rc.2 (1.12.0 is outside it)
  • CVE-2012-6662
    No published release is affected
    No published release is affected
  • CVE-2010-5312
    No published release is affected
    No published release is affected
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 7

  • CVE-2022-31160Medium 6.1

    jQuery UI contains potential XSS vulnerability when refreshing a checkboxradio with an HTML-like initial text label

    Affected: fixed in 1.13.2.

    Fixed in 1.13.2 (released Jul 19, 2022, 1 day before disclosure).

    The latest release, 1.14.2, is not affected.

  • CVE-2021-41184Medium 6.5

    XSS in the `of` option of the `.position()` util

    Affected: fixed in 1.13.0.

    Fixed in 1.13.0 (released Oct 28, 2021, 2 days after disclosure).

    The latest release, 1.14.2, is not affected.

  • CVE-2021-41183Medium 6.5

    XSS in `*Text` options of the Datepicker widget

    Affected: fixed in 1.13.0.

    Fixed in 1.13.0 (released Oct 28, 2021, 2 days after disclosure).

    The latest release, 1.14.2, is not affected.

  • CVE-2021-41182Medium 6.5

    XSS in the `altField` option of the Datepicker widget

    Affected: fixed in 1.13.0.

    Fixed in 1.13.0 (released Oct 28, 2021, 2 days after disclosure).

    The latest release, 1.14.2, is not affected.

  • Cross-site scripting (XSS) vulnerability in jQuery UI before 1.12.0 might allow remote attackers to inject arbitrary web script or HTML…

    Affected: fixed in 1.12.0.

    Fixed in 1.12.0 (released Jul 23, 2016, 235 days before disclosure).

    The latest release, 1.14.2, is not affected.

  • Cross-site scripting (XSS) vulnerability in the default content option in jquery.ui.tooltip.js in the Tooltip widget in jQuery UI before…

    Affected: fixed in 1.10.0.

    Fixed in 1.10.4 (released Aug 18, 2016, 633 days after disclosure, the advisory names 1.10.0, which was never published).

    The latest release, 1.14.2, is not affected.

  • Cross-site scripting (XSS) vulnerability in jquery.ui.dialog.js in the Dialog widget in jQuery UI before 1.10.0 allows remote attackers to…

    Affected: from 1.7.0, fixed in 1.10.0.

    Fixed in 1.10.4 (released Aug 18, 2016, 633 days after disclosure, the advisory names 1.10.0, which was never published).

    The latest release, 1.14.2, is not affected.