My site uses a library with a known security weakness
Worth a look
Most websites are assembled from other people's building blocks. When one of those blocks has a publicly documented weakness in the version your site is using, it's listed in a public database — which means attackers can find every site still running it without doing any work.
What a “library” is here
A shared lump of code that does a common job so nobody has to write it again — animating a menu, validating a form, running a carousel. jQuery is the best-known example and still runs on a very large share of the web.
Nobody chose these individually in most cases. They arrive bundled inside a theme or a plugin, which is why an owner can be running a five-year-old copy of something without ever having heard of it.
How worried should you be?
It depends heavily on the weakness, and this is where honest reporting matters. Many library vulnerabilities require quite specific conditions to exploit and won't affect a straightforward brochure site at all. Some are genuinely serious.
What makes it worth acting on regardless is the asymmetry: the weakness is public and the fix is usually a version bump. It's a cheap thing to close and a needlessly cheap thing for someone else to find.
The most common real-world consequence for a small-business site is cross-site scripting — an attacker getting their own code to run in your visitors' browsers, which can be used to steal form contents or redirect people elsewhere.
The one that tends to be awkward
Updating a library that arrived inside a theme sometimes breaks the theme, because the theme was written against the old version. That's not a reason to leave it, but it is a reason to expect the job to take longer than “update one file” and to test properly afterwards.
If the theme is abandoned and can't be updated safely, the honest conversation is about replacing the theme rather than patching around it.
How to check this yourself
- This is difficult to do by eye — the version number is usually buried in a file path or a comment inside the page source.
- Google's own PageSpeed Insights, which is free, reports known-vulnerable front-end libraries as part of its audit. So does Gus, using the same underlying data.
- Gus's in-depth check names the library and the version rather than just grading you.
What to ask your web person
Copy this. It's phrased so you don't have to know the jargon to ask for the right thing.
A scan flagged that we're loading [library and version], which has a publicly listed vulnerability. Could you update it to a current version, and check whether it's coming from our theme or a plugin? If it's bundled in something abandoned, I'd rather know now than patch around it.
Want to know if this applies to your site?
Gus checks this and everything else in the free check-up, then explains what he found in plain English. It's free, there's no account, and it takes about a minute.