NuGetPackage

jQuery.UI.Combined

7 known vulnerabilities (4 medium), with the versions each affects and the releases that fix them.

Latest release: 1.14.1 (Nov 15, 2024): no advisory affects it
Newest unaffected release: 1.14.1 (Nov 15, 2024), the latest release
Advisories: 7 · 4 medium

Releases: 38 since 1.8.9 (Mar 3, 2011)
Registry: NuGet
Releases read: Nov 8, 2026

Version timeline

CVE-2022-31160
Affects 1.8.9 to 1.13.1 (1.13.2 is outside it)
CVE-2021-41184
Affects 1.8.9 to 1.12.1 (1.13.0 is outside it)
CVE-2021-41183
Affects 1.8.9 to 1.12.1 (1.13.0 is outside it)
CVE-2021-41182
Affects 1.8.9 to 1.12.1 (1.13.0 is outside it)
CVE-2016-7103
Affects 1.8.9 to 1.11.4 (1.12.0 is outside it)
CVE-2012-6662
Affects 1.8.9 to 1.9.2 (1.10.0 is outside it)
CVE-2010-5312
Affects 1.8.9 to 1.9.2 (1.10.0 is outside it)

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 7

CVE-2022-31160Medium 6.1
jQuery UI contains potential XSS vulnerability when refreshing a checkboxradio with an HTML-like initial text label
Affected: fixed in 1.13.2.
Fixed in 1.13.2 (released Jul 28, 2022, 8 days after disclosure).
The latest release, 1.14.1, is not affected.
CVE-2021-41184Medium 6.5
XSS in the `of` option of the `.position()` util
Affected: fixed in 1.13.0.
Fixed in 1.13.0 (released Nov 15, 2021, 20 days after disclosure).
The latest release, 1.14.1, is not affected.
CVE-2021-41183Medium 6.5
XSS in `*Text` options of the Datepicker widget
Affected: fixed in 1.13.0.
Fixed in 1.13.0 (released Nov 15, 2021, 20 days after disclosure).
The latest release, 1.14.1, is not affected.
CVE-2021-41182Medium 6.5
XSS in the `altField` option of the Datepicker widget
Affected: fixed in 1.13.0.
Fixed in 1.13.0 (released Nov 15, 2021, 20 days after disclosure).
The latest release, 1.14.1, is not affected.
CVE-2016-7103Unrated
Cross-site scripting (XSS) vulnerability in jQuery UI before 1.12.0 might allow remote attackers to inject arbitrary web script or HTML…
Affected: fixed in 1.12.0.
Fixed in 1.12.0 (released Jul 19, 2016, 239 days before disclosure).
The latest release, 1.14.1, is not affected.
CVE-2012-6662Unrated
Cross-site scripting (XSS) vulnerability in the default content option in jquery.ui.tooltip.js in the Tooltip widget in jQuery UI before…
Affected: fixed in 1.10.0.
Fixed in 1.10.0 (released Jan 18, 2013, 675 days before disclosure).
The latest release, 1.14.1, is not affected.
CVE-2010-5312Unrated
Cross-site scripting (XSS) vulnerability in jquery.ui.dialog.js in the Dialog widget in jQuery UI before 1.10.0 allows remote attackers to…
Affected: from 1.7.0, fixed in 1.10.0.
Fixed in 1.10.0 (released Jan 18, 2013, 675 days before disclosure).
The latest release, 1.14.1, is not affected.