83% of PrestaShop Websites Showing a jQuery Version Run One With Known Flaws vs 36.1% Web-Wide

A small fashion boutique opened its PrestaShop store years ago. A hobby shop set up OpenCart because it was free. A large company built a decade of custom scripts for its store finder and product filters. All three still work, and all three still load the version of jQuery they launched with. A small business on a newer theme, meanwhile, got a current jQuery by default the day its site went live.

jQuery is a free JavaScript library, a package of ready-made code that websites use for menus, sliders, forms and pop-ups. Every jQuery version before 3.5.0 carries two published cross-site scripting flaws, a type of weakness that can let an attacker run their own code in a visitor's browser. Security scanners and payment-compliance checks flag these versions on sight, which makes old jQuery one of the most common security findings on the web, and on a store that takes cards, one of the most consequential.

Across the web, 36.1% of websites that show their jQuery version run one older than 3.5.0. Self-hosted store platforms do far worse: 83% of PrestaShop websites and 82% of OpenCart websites that show a version are below 3.5.0, and Magento and Joomla are above the web average too. And the most popular sites are worse, not better: 44.3% of the 10,000 most visited websites that use jQuery run a vulnerable version.

We used two samples. The first is the public HTTP Archive crawl of September 2026, which records the jQuery version loaded on each website homepage where the version can be read: 9,504,650 homepages load jQuery and show which version. We counted those running a version older than 3.5.0 and grouped websites by popularity using Google's Chrome UX Report, which ranks sites by how many Chrome users visit them; the "top 10,000" are the 10,000 most visited websites in that ranking. The second is 25,708 public websites, mostly in the US, checked on September 23 to 24, 2026, among them 7,515 WordPress, 956 Drupal, 707 Joomla, 550 Magento, 426 OpenCart, 387 PrestaShop, 1,636 Shopify, 2,004 Squarespace and 1,853 Wix websites. For the four self-hosted platforms in focus we recorded the jQuery version each website loads, where the version was visible, and for every website we recorded whether the website redirects to its secure https:// address and whether its server announces its software.

A website runs outdated or vulnerable jQuery when its version is older than 3.5.0. Every version before 3.5.0 is affected by CVE-2020-11022 and CVE-2020-11023, the two cross-site scripting flaws that release fixed; a CVE is the public ID given to a documented security flaw. Version 1.x is the oldest release line still in use. A website has no HTTPS redirect when the plain http:// address leaves the visitor on the unencrypted page instead of moving them to the secure https:// version, which browsers label "Not secure". A server that shows its software announces the name of the program it runs to every visitor, which tells attackers what to look for.

The four self-hosted platforms all sit above the web-wide rate of 36.1%. PrestaShop is highest at 83%, with 77% of PrestaShop websites that show a version still on the 1.x line. OpenCart follows at 82%, Magento at 62% and Joomla at 52%. These are platforms where the owner installs and upgrades the software, so the jQuery file stays whatever the store or template shipped with until someone changes it.

OpenCart gives the most complete picture: 61% of OpenCart websites show their jQuery version, more than any other platform, against 24.2% for Magento, 19.9% for PrestaShop and 7.9% for Joomla. So the OpenCart figure describes most OpenCart stores, not just a visible few. And three of the four are store platforms that take card payments, where the two cross-site scripting flaws are the kind of hole attackers use to inject code into checkout pages.

On PrestaShop and OpenCart, a single old version dominates. jQuery 1.11.0 runs on 66.2% of PrestaShop websites that show a version; it is the release bundled with the PrestaShop 1.6 series, so its share is a sign of how many stores still run 1.6-era code, core, theme and modules alike. jQuery 2.1.1 runs on 73.5% of OpenCart websites that show a version; it is the version bundled with OpenCart 2.x and 3.x, while OpenCart 4 moved to jQuery 3. Only one OpenCart store loads a 1.x release, so OpenCart's old stores are one major version behind rather than two.

Magento and Joomla split into two camps. On Magento, the patched 3.7.1 is the most common single version, on 26.3% of websites that show one, but the 1.x releases together make up more than half, led by 1.10.2 on 12.8%, the version Magento 1's default responsive theme shipped with. Magento 1 reached end of life in 2020. On Joomla, the patched 3.5.1 and 3.7.0 lead at 16.1% and 14.3%, yet a quarter of Joomla websites that show a version still load a 1.x release such as 1.7.2 or 1.11.1.

The split describes two kinds of website on every platform: ones that have been upgraded to a current release, which ships a current jQuery, and ones still running the template and extensions they launched with. An old jQuery file is a maintenance marker as much as a security finding.

For most maintenance problems, popular websites do better than small ones, because they have larger teams and budgets. jQuery runs the other way. The vulnerable share falls steadily from the most visited websites to the least: 44.3% in the top 10,000, 42.3% from 10k to 100k, 41.9% from 100k to one million, 36.7% from one million to 10 million and 34.6% beyond that.

A likely reason is the code that has built up around jQuery. Large sites carry years of custom scripts that call functions jQuery 3 removed, so upgrading means finding and rewriting all of them. Smaller sites usually run on a theme or platform that ships a current jQuery by default, so they stay current without anyone deciding to. The top 10,000 also have the highest share still on jQuery 1.x or 2.x, at 32.1%.

36.1% of websites that show their jQuery version, 3,427,654 homepages, run a version older than 3.5.0. Because jQuery loads on 62.2% of all website homepages, vulnerable jQuery sits on 22.2% of the entire web, more than one homepage in five.

When one flaw sits on millions of sites, attackers can scan for all of them at once and try the published exploit on each. It is also one of the first findings a security scanner reports, so a business that runs one for a client, an insurer or a payment provider will see it at the top of the list.

Of the 3.4 million homepages on vulnerable jQuery, 2,607,064 are below version 3.0, which means they skipped an entire major release. 27.4% of all websites that show their jQuery version are on jQuery 1.x or 2.x. These are not sites that fell one update behind; their front end has not been touched in years.

The long tail holds most of them. Websites outside the million most visited account for 94.4% of all homepages running jQuery older than 3.5.0: 53.4% sit between one million and 10 million, and 41% beyond the top 10 million. The top 10,000 hold just 1,535 homepages with vulnerable jQuery. For small businesses the lower rate is little comfort: automated attacks do not pick targets by popularity; they try every site that matches.

The same platforms that keep old jQuery are the ones most likely to leave basic server settings as they were first set. 19.3% of OpenCart websites and 12.5% of Joomla websites do not redirect visitors from the plain http:// address to the secure https:// one, the two highest rates of the nine platforms, against 9.1% across all 25,708 websites. Magento sits at 8.9%, six times the 1.4% of Shopify stores, and PrestaShop does well at 4.9%, the same rate as WordPress websites. Hosted platforms that manage this for the owner barely register: 0.1% of Wix websites.

OpenCart websites also announce their server software 11% of the time, the second highest rate of the nine platforms after Drupal, against 5.3% across all websites and 0.1% of Shopify stores. A hosted store gets its security settings from the platform; a self-hosted store gets them from whoever set up the server, and they stay that way until someone changes them. Both fixes take minutes.

Check which jQuery version your site loads: open your browser's developer console on your homepage and type jQuery.fn.jquery. If it is below 3.5.0, find out whether your platform, theme, a plugin, an extension or custom code loads it. On PrestaShop 1.6, OpenCart 2.x or 3.x, Magento 1 or an old Joomla release, the old jQuery comes with the platform itself, so the real fix is upgrading the platform: copy the site to a test environment, list the theme and extensions you depend on, and check them there first, since they are what usually holds an upgrade back. If the upgrade would mean rebuilding the theme and replacing most extensions anyway, compare it with moving to another platform.

If your own scripts depend on old jQuery, upgrade on a staging copy with jQuery Migrate, a compatibility add-on from the jQuery team, in place. It lets old scripts keep running on jQuery 3 and logs a warning each time a script uses a removed function; fix each warning, then remove Migrate. For large sites with years of custom code, do it section by section rather than all at once. Then fix the server basics: redirect every http:// address to https:// and ask your host to hide the server software name.

Keep it current once it is fixed. A website management plan that checks the jQuery and other libraries a site loads, and tests every upgrade on staging before it reaches the live site, keeps a store from sliding back to the version it launched with.

Need help with this? See our website maintenance services.

Embed this research

Cite this study