Check 51 of 54 · Supply chain
Old JavaScript libraries with known holes, loaded on your home page.
Engine 1.57.0, read 25 October 2026
Whose code runs on your website?
The version written in each script's address: its file name, its folder path, a package@version address, or the ?ver= WordPress puts on a library it ships. Five well-known libraries are covered, jQuery and Bootstrap among them. Each published advisory counts only for the versions it affects.
A published advisory tells anyone, attackers included, where an old library is weak.
A failure is a finding in your result. The check is scored, so it can lower your score, and the Full Report gives every finding its severity and a fix. If the check cannot finish, it is recorded as unknown: it carries no penalty, and it is never a pass.
A short, high-confidence list, read only where an address states a version. Whether a vulnerability can be used against your site depends on how the site uses the library, which this check does not test. On a site that builds its pages in the browser, only the scripts in the page as served are read. If that page loads nothing from outside, it reports unknown.
Check 51 is one of 4 in Supply chain. See it in its row on the scanner page, beside the rest of Supply chain.
The free check includes this one and takes about 30 seconds. No account. Nothing to install.