Last jQuery 2.x release
jQuery 2.2.4 vulnerabilities
jQuery 2.2.4 is the last jQuery 2.x release. The OSV open-source vulnerability database lists 4 vulnerabilities for this version, none of them critical. One of them is on the CISA catalogue of known exploited vulnerabilities. jQuery 1.x and 2.x get no more fixes, and moving to 3.x often breaks the plugins built on them.
- 4known vulnerabilities
- 0critical
- 0high
- 1exploited in the wild
Exploited in the wild
1 flaw in jQuery 2.2.4 is being exploited.
CVE-2020-11023 is on the CISA catalogue of known exploited vulnerabilities. On a distribution past end of life, nobody backports their fixes unless you arrange it.
What you can do
Keep jQuery 2.2.4, patched
We backport the security fixes to the jQuery version your application loads, tested against your pages before delivery. A fix for a new vulnerability arrives within 48 hours of your order, or within 24 hours with priority delivery.
Upgrade
Move to a current jQuery release once your plugins and code can make the jump. Our fixes keep you safe while you plan it.
Assess first
Our assessment shows which vulnerabilities are real on your servers, what else is past end of life, and the remediation plan.
All 4 known vulnerabilities in jQuery 2.2.4
OSV.dev, the open-source vulnerability database used by GitHub and Google, 28 October 2026, highest score first. Fixed in: the first upstream release with the fix, where OSV records it. Exploited: listed in the CISA catalogue of known exploited vulnerabilities.
| CVE | Score | Severity | Published | Fixed in | Description |
|---|---|---|---|---|---|
| CVE-2020-11022 | 6.9 | Medium | 2020-04-29 | 3.5.0 | Potential XSS vulnerability in jQuery |
| CVE-2020-11023 Exploited | 6.9 | Medium | 2020-04-29 | 3.5.0 | Potential XSS vulnerability in jQuery |
| CVE-2015-9251 | 6.1 | Medium | 2018-01-22 | 3.0.0 | Cross-Site Scripting (XSS) in jquery |
| CVE-2019-11358 | 6.1 | Medium | 2019-04-26 | 3.4.0 | XSS in jQuery as used in Drupal, Backdrop CMS, and other products |