Originally published on endoflife.ai.
Let's clear up the most-searched question first: jQuery is not end-of-life. jQuery core is still actively maintained — the 3.x line gets security releases and 4.x is the modern successor. On the EOL Risk Score, jQuery sits at just 20 (Low).
But that headline hides the real problem. The parts of the jQuery ecosystem most sites depend on are end-of-life: jQuery 1.x and 2.x got no releases since 2016, jQuery UI reached EOL on August 5, 2024, and jQuery Mobile was archived years ago. And the catch the Low score doesn't capture — old jQuery versions carry known, patchable XSS vulnerabilities.
jQuery core versions — what's maintained
| Version | Maintenance reality | Status | Risk Score |
|---|---|---|---|
| jQuery 1.x | No releases since 1.12.4 (May 2016) | Unmaintained | 20 |
| jQuery 2.x | No releases since 2.2.4 (May 2016) | Unmaintained | 20 |
| jQuery 3.x | Maintained · latest 3.7.1 | Maintained | 20 |
| jQuery 4.x | Newest line · drops legacy IE | Current | 20 |
"No EOL date" ≠ "no updates." jQuery 1.x/2.x have a Low score because jQuery never formally declared them EOL — but the project stopped shipping releases for both in May 2016. In practice they're unmaintained; the only supported path is 3.x or 4.x.
The real risk: old versions, known CVEs
The EOL Risk Score measures lifecycle status. It doesn't track version-specific vulnerabilities — and jQuery has well-known ones fixed in specific releases:
CVE-2020-11022 and CVE-2020-11023 — XSS flaws fixed in jQuery 3.5.0 (April 2020). Any jQuery older than 3.5.0 — all of 1.x/2.x and early 3.x — is vulnerable.
CVE-2019-11358 — prototype pollution viajQuery.extend, fixed in jQuery 3.4.0.
If you're running jQuery below 3.5.0, you're shipping known XSS to your users. The fix is free: upgrade to current 3.x (3.7.1) or 4.x.
This is the same blind spot covered in the CVE blind spot — lifecycle status and CVE exposure are two different axes, and you have to check both.
jQuery UI & jQuery Mobile — the EOL pieces
Unlike jQuery core, jQuery UI is genuinely end-of-life — dated to August 5, 2024, with a Risk Score of 55 (Elevated). The widget library (datepickers, dialogs, autocomplete) is no longer developed. jQuery Mobile went further — archived and deprecated years ago.
Replacements: modern component libraries or native HTML (<dialog>, <input type="date">) cover most jQuery UI use cases.
How to fix it
Find which jQuery version you actually ship.jQuery.fn.jqueryprints the loaded version in the console. Anything below 3.5.0 is a priority.
Add jQuery Migrate. It restores deprecated APIs and logs every deprecation your code hits — a checklist from your real usage. Use it as a temporary bridge.
Upgrade to current jQuery 3.x (3.7.1). Closes the known XSS CVEs; most compatible target.
Replace jQuery UI and jQuery Mobile. Separately EOL — swap for maintained components or native controls.
Consider whether you still need jQuery. Much of what it was indispensable for is now native (querySelectorAll,fetch,classList). The goal is "patched," not necessarily "removed."
Full guide and live data at endoflife.ai. Scan your front-end free with the Stack Scanner.