CVE-2011-4969
jQuery vulnerable to Cross-Site Scripting (XSS)
CVE-2011-4969 is a medium vulnerability (CVSS 4.3) in Jquery, published March 8, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 19.2%, the 97th percentile. Fixed in jquery 1.6.3.
Cross-site scripting (XSS) vulnerability in jQuery before 1.6.3, when using location.hash to select elements, allows remote attackers to inject arbitrary web script or HTML via a crafted tag.
Exploit likelihood
What each source reports
NVD Score used
Cross-site scripting (XSS) vulnerability in jQuery before 1.6.3, when using location.hash to select elements, allows remote attackers to inject arbitrary web script or HTML via a crafted tag.
- Record
CVE-2011-4969- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE List No score
Cross-site scripting (XSS) vulnerability in jQuery before 1.6.3, when using location.hash to select elements, allows remote attackers to inject arbitrary web script or HTML via a crafted tag.
- Record
CVE-2011-4969- Updated
- 2026-11-02
EUVDEUVD-2022-2521 No score
Cross-site scripting (XSS) vulnerability in jQuery before 1.6.3, when using location.hash to select elements, allows remote attackers to inject arbitrary web script or HTML via a crafted tag.
- Record
EUVD-2022-2521- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-579v-mp3v-rrw5 No score
jQuery vulnerable to Cross-Site Scripting (XSS)
Cross-site scripting (XSS) vulnerability in jQuery before 1.6.3, when using location.hash to select elements, allows remote attackers to inject arbitrary web script or HTML via a crafted tag.
- Record
GHSA-579v-mp3v-rrw5- Weakness
- CWE-79
- Updated
- 2026-11-02
OSVAZL-44421 No score
CVE-2011-4969 affecting package python-genshi 0.7.9-1
Cross-site scripting (XSS) vulnerability in jQuery before 1.6.3, when using location.hash to select elements, allows remote attackers to inject arbitrary web script or HTML via a crafted tag.
- Record
AZL-44421- Updated
- 2026-11-02
OSVCLSA-2026-1787916782 No score
TuxCare security update for jquery (7 CVEs)
TuxCare rebuilt jquery to address 7 CVEs. Fixed in 1.4.1-tuxcare.1.
- Record
CLSA-2026-1787916782- Updated
- 2026-11-02
Show 5 moreShow less
OSVCLSA-2026-1787920143 No score
TuxCare security update for jquery (8 CVEs)
TuxCare rebuilt jquery to address 8 CVEs. Fixed in 1.4.2-tuxcare.1.
- Record
CLSA-2026-1787920143- Updated
- 2026-11-02
OSVCLSA-2026-1787920316 No score
TuxCare security update for jquery (7 CVEs)
TuxCare rebuilt jquery to address 7 CVEs. Fixed in 1.4.3-tuxcare.1.
- Record
CLSA-2026-1787920316- Updated
- 2026-11-02
OSVCLSA-2026-1788956475 No score
TuxCare security update for jquery (6 CVEs)
TuxCare rebuilt jquery to address 6 CVEs. Fixed in 1.3.2-tuxcare.1.
- Record
CLSA-2026-1788956475- Updated
- 2026-11-02
OSV No score
Cross-site scripting (XSS) vulnerability in jQuery before 1.6.3, when using location.hash to select elements, allows remote attackers to inject arbitrary web script or HTML via a crafted tag.
- Record
CVE-2011-4969- Updated
- 2026-11-02
OSVGHSA-579v-mp3v-rrw5 No score
jQuery vulnerable to Cross-Site Scripting (XSS)
Cross-site scripting (XSS) vulnerability in jQuery before 1.6.3, when using location.hash to select elements, allows remote attackers to inject arbitrary web script or HTML via a crafted tag.
- Record
GHSA-579v-mp3v-rrw5- Weakness
- CWE-79
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
jquerynpm |
before 1.6.3 | 1.6.3 |
jQueryNuGet |
before 1.6.3 | 1.6.3 |
jquery-railsRubyGems |
before 1.0.16 | 1.0.16 |
org.webjars.npm:jqueryMaven |
before 1.6.3 | 1.6.3 |
python-genshiAzure Linux:3 |
through 0.7.9-1 | None known |
jqueryTuxCare:npm |
1.4.1-tuxcare.0 up to 1.4.1-tuxcare.1, plus listed versions 1.4.1 |
1.4.1-tuxcare.1 |
jqueryTuxCare:npm |
1.4.2-tuxcare.0 up to 1.4.2-tuxcare.1, plus listed versions 1.4.2 |
1.4.2-tuxcare.1 |
jqueryTuxCare:npm |
1.4.3-tuxcare.0 up to 1.4.3-tuxcare.1, plus listed versions 1.4.3 |
1.4.3-tuxcare.1 |
jqueryTuxCare:npm |
1.3.2-tuxcare.0 up to 1.3.2-tuxcare.1, plus listed versions 1.3.2 |
1.3.2-tuxcare.1 |
jQueryNuGet |
before 1.6.3, plus listed versions 1.4.11.4.21.4.31.4.41.5.0 Show 5 moreShow less1.5.11.5.21.6.01.6.11.6.2 |
1.6.3 |
jquery-railsRubyGems |
before 1.0.16, plus listed versions 0.1.10.1.20.1.30.20.2.1 Show 23 moreShow less0.2.20.2.30.2.40.2.50.2.60.2.71.01.0.11.0.101.0.111.0.121.0.131.0.141.0.151.0.21.0.31.0.41.0.51.0.61.0.71.0.81.0.91.0.rc |
1.0.16 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | affected | |
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
securitytracker.com/id/1036620
osvdb.org/80056
bugs.jquery.com/ticket/9521
h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05111017
blog.jquery.com/2011/09/01/jquery-1-6-3-released
blog.mindedsecurity.com/2011/07/jquery-is-sink.html
Show 14 moreShow less
github.com/jquery/jquery/commit/db9e023e62c1ff5d8f21ed9868ab6878da2005e9
ubuntu.com/usn/USN-1722-1
openwall.com/lists/oss-security/2013/01/31/3
securityfocus.com/bid/58458
security.netapp.com/advisory/ntap-20190416-0007
lists.apache.org/thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd94ae84fd60a7f8%40%3Ccommits.pulsar.apache.org%3E
nvd.nist.gov/vuln/detail/CVE-2011-4969
security.snyk.io/vuln/SNYK-DOTNET-JQUERY-450224