Cross-site Scripting Vulnerability in jQuery Validation Package

CVE-2025-3573

What is CVE-2025-3573?

The jQuery Validation package prior to version 1.20.0 is vulnerable to a Cross-site Scripting (XSS) attack triggered by the showLabel() function. This vulnerability allows attackers to exploit a user-controlled placeholder value, leading to potentially harmful content being executed in the user's browser. By manipulating this input, an attacker could introduce malicious scripts that may compromise user data or hijack user sessions. It is essential to update to the latest version to mitigate any risks associated with this vulnerability.

References