CVE-2011-4969 Cross-site scripting (XSS) vulnerability in jQuery before 1.6.3, when using location.hash to select elements, allows remote attackers to inject arbitrary web script or HTML via a crafted tag.

Api.Msrc.Microsoft • February 18, 2026

Share: View original

Information published.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Multiple jQuery XSS Vulnerabilities Affecting Versions Prior to 1.9.0 Two critical Cross-site Scripting (XSS) vulnerabilities in jQuery have been identified, affecting versions prior to 1.9.0 and 1.6.3. CVE-2012-6708 allows attackers to exploit the jQuery(strInput) function due to improper handling of HTML input, while CVE-2011-4969 enables injection of arbitrary scripts via location.hash. Users of these vulnerable jQuery versions are at risk of remote attacks. 2 sources 41

Extracted Entities

CVEs (1)

MITRE ATT&CK (1)

T1059.007 - JavaScript

Platforms (1)

Vulnerabilities (1)