Update the vulnerable JavaScript library on WordPress

Why it matters

The page loads a JavaScript library version with a published vulnerability, and attackers scan for these. Updating to the fixed release closes the hole without changing how the site looks.

Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.

The fix

1. Back up the site, then update from Dashboard, Updates. WordPress core bundles jQuery and several other libraries, and a core update brings in newer versions of them. Then update all themes and plugins.
2. Open the page source and find the script address from the finding. If the path contains /wp-content/plugins/<name>/ or /wp-content/themes/<name>/, that plugin or theme ships its own old copy. Update it, and if no update exists, contact the developer or replace it.
3. Do not remove WordPress's own jQuery, swap it for a CDN copy, or dequeue it to get rid of the finding. Many plugins depend on the version that core ships and this breaks them. Keep core updated instead.
4. WP-CLI can do the updates in one step. Run wp core update, wp plugin update --all and wp theme update --all, then clear caches and check the site.

wp core update
wp plugin update --all
wp theme update --all

Read the documentation ↗(opens in a new tab)

Related

• Reported by the javascript libraries with known vulnerabilities check