title: Is jQuery 1.x vulnerable to "non-explicit data type cross-site scripting"?
body: <p>We recently received the following email from <a href="https://nospam_srcclr.com" rel="nofollow">https://nospam_srcclr.com</a> (remove nospam_ for the real URL).</p>
  
  <blockquote>
    <p>Thank you for your prompt reply. We have identified [our project] as being vulnerable to a cross-site scripting vulnerability through JQuery. </p>
    
    <p><a href="https://nospam_srcclr.com/security/cross-site-scripting-xss-through-execution-non-explicit-data-type/javascript/sid-2250/fix" rel="nofollow">https://nospam_srcclr.com/security/cross-site-scripting-xss-through-execution-non-explicit-data-type/javascript/sid-2250/fix</a></p>
    
    <p>A copy of the JQuery version 1.11.3 is included in the project here.  JQuery is vulnerable to cross-site scripting through execution of non-explicit data type. The vulnerable section of code used in [our project] is seen here.</p>
    
    <p>To mitigate this issue, we recommend upgrading JQuery to 3.0.0.</p>
  </blockquote>
  
  <p>Is jQuery 1.x actually unsafe to use?</p>