Skip to main content
MEDIUM

CVE-2022-31160

CVSS v3

6.1

MEDIUM

EPSS Score

2.7 %

exploit probability, as of 2026-10-19

CISA KEV

No

known exploited

Exploitation

—

SSVC status

Get an alert for each new CVE published for jqueryui.

Set up CVE WatchFree account · no credit card

Affected and fixed versions

Packages from OSV.dev and products from the vendors' CSAF advisories.

version not verifiedVersions not verified: read as OSV.dev and the vendors publish them, not checked against each vendor's release list.

Packages

  • jquery-uinpmall versions · fixed in 1.13.2
  • jquery-ui-railsRubyGemsall versions · fixed in 8.0.0
  • jQuery.UI.CombinedNuGetall versions · fixed in 1.13.2
  • org.webjars.npm:jquery-uiMavenall versions · fixed in 1.13.2

Vendor advisories

  • CVE-2022-31160 Red Hat Product Security7 known affected

    jqueryui: XSS when refreshing a checkboxradio with an HTML-like initial text label

    hawtio as a component of Red Hat Fuse 7 · swagger-ui as a component of Red Hat Fuse 7 · python-XStatic-jquery-ui.src as a component of Red Hat OpenStack Platform 13 (Queens)

Full record on NVD

Description

jQuery UI is a curated set of user interface interactions, effects, widgets, and themes built on top of jQuery. Versions prior to 1.13.2 are potentially vulnerable to cross-site scripting. Initializing a checkboxradio widget on an input enclosed within a label makes that parent label contents considered as the input label. Calling `.checkboxradio( "refresh" )` on such a widget and the initial HTML contained encoded HTML entities will make them erroneously get decoded. This can lead to potentially executing JavaScript code. The bug has been patched in jQuery UI 1.13.2. To remediate the issue, someone who can change the initial HTML can wrap all the non-input contents of the `label` in a `span`.

Technical details

Published
2022-07-20

Frequently asked questions

What is CVE-2022-31160?

jQuery UI is a curated set of user interface interactions, effects, widgets, and themes built on top of jQuery. Versions prior to 1.13.2 are potentially vulnerable to cross-site scripting. Initializing a checkboxradio widget on an input enclosed within a label makes that parent label contents considered as the input label. Calling `.checkboxradio( "refresh" )` on such a widget and the initial HTML contained encoded HTML entities will make them erroneously get decoded. This can lead to potentially executing JavaScript code. The bug has been patched in jQuery UI 1.13.2. To remediate the issue, someone who can change the initial HTML can wrap all the non-input contents of the `label` in a `span`.

Is CVE-2022-31160 actively exploited?

Active exploitation of CVE-2022-31160 has not been confirmed. Its EPSS score was 2.7% on 2026-10-19, the estimated probability of exploitation in the next 30 days.

What is the CVSS score for CVE-2022-31160?

CVE-2022-31160 has a CVSS v3 base score of 6.1 (MEDIUM severity).

Running jqueryui? Hear about its next vulnerability

CVE Watch matches each new CVE to the vendors and products you list (vendor and product, not the version) and puts it in your alerts with its KEV and EPSS status.

Get alerts for this productCISA KEV additions, October 2026Search CVEs

Already have an account? Open CVE WatchNo credit card required · No monthly cap on website lookups · 250 API requests/month

Go further

Related vulnerabilities

Same product first, then the same vendor advisory and the same publication week.

Back to CVE Database