PT-2020-6926
CVE-2020-7656
·
Published
2020-05-19
·
Updated
2025-09-29
Description by
CVSS 2.0
6.4
MediumMetricsAV:N/AC:L/Au:N/C:P/I:P/A:N
Name of the Vulnerable Software and Affected Versions
jquery versions prior to 1.9.0
Description
The issue allows Cross-site Scripting attacks via the load method. The load method fails to recognize and remove
<script> HTML tags that contain a whitespace character, i.e: </script >, which results in the enclosed script logic to be executed. This allows attackers to execute arbitrary JavaScript in a victim's browser.Recommendations
Upgrade to version 1.9.0 or later.
Found an issue in the description? Have something to add? Feel free to write us 👾