🛡️ CVE-2022-31160
🟡 CVSS 6.1 — Medium ⚠️ Exploit Public CWE-79 NVD
6.1
CVSS Score
0 Low4 Medium7 High9 Critical10

Description

jQuery UI is a curated set of user interface interactions, effects, widgets, and themes built on top of jQuery. Versions prior to 1.13.2 are potentially vulnerable to cross-site scripting. Initializing a checkboxradio widget on an input enclosed within a label makes that parent label contents considered as the input label. Calling `.checkboxradio( "refresh" )` on such a widget and the initial HTML contained encoded HTML entities will make them erroneously get decoded. This can lead to potentially executing JavaScript code. The bug has been patched in jQuery UI 1.13.2. To remediate the issue, someone who can change the initial HTML can wrap all the non-input contents of the `label` in a `span`.

Details

Severity MEDIUM
CVSS Score 6.1
CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CWE CWE-79
Public Exploit ⚠️ Yes
Source NVD
Published 2022-07-20
Updated 2026-06-15
Modified 2024-11-21

Affected Packages

Software From version Fixed in
debian-linux
fedora
h300s-firmware
h410c-firmware
h410s-firmware
h500s-firmware
h700s-firmware
jquery-ui
jquery-ui-checkboxradio
jquery-ui-rails 8.0.0
jquery.ui.combined 1.13.2
oncommand-insight
org.webjars.npm:jquery-ui 1.13.2

References

Exploit, Mitigation, Release Notes, Third Party Advisory https://github.com/jquery/jquery-ui/security/advisories/GHSA-h6gj-6jjq-h8g9
Exploit, Mitigation, Release Notes, Third Party Advisory https://github.com/jquery/jquery-ui/security/advisories/GHSA-h6gj-6jjq-h8g9

Similar Threats

Free Vulnerability Check

Is your WordPress site affected?

BotEraser helps you identify potentially vulnerable plugins and themes by checking your installation against known CVE records.

Scan My Site Free →

No credit card required  ·  Results in minutes

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the vulnerabilities listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.