description: jquery prior to 1.9.0 allows Cross-site Scripting attacks via the load method. The load method fails to recognize and remove "<script>" HTML tags that contain a whitespace character, i.e: "</script >", which results in the enclosed script logic to be executed.
problem types: Cross-site Scripting
affected:
{
vendor: n/a
product: jquery
versions:
version: All versions prior to version 1.9.0, status: affected
}