Versions of the package jquery-validation before 1.20.0 are vulnerable to Cross-site Scripting (XSS) in the showLabel() function, which may take input from a user-controlled placeholder value. This value will populate a message via $.validator.messages in a user localizable dictionary.
| Package (Ecosystem) | Introduced | Fixed | Limit |
|---|---|---|---|
| jquery-validation(npm) | 0 | 1.20.0 | N/A |
CVSS Metrics
