Videos
One important distinction to make here is that only because the jQuery library contains known vulnerabilities, it does not mean that the website is vulnerable to the contained vulnerability.
As with many libraries, a website using jQuery will only be affected by a vulnerability if it uses the vulnerable function in a vulnerable way. If it does not use the functionality at all, the issues will not be exploitable. They might become exploitable if the used functionality on the website changes.
Looking for example at the mentioned jQuery 2.1.1. This version is, according to the site http://research.insecurelabs.org/jquery/test/ vulnerable to
- jQuery issue 2432 - 3rd party
$.get()auto executes if content type istext/javascript - jQuery issue 11974 -
parseHTMLexecutes inline scripts like event handlers
The first issue (https://github.com/jquery/jquery/issues/2432) can be exploited only if the vulnerable site uses $.get() for a URL that returns a response that can be influenced by you. If you cannot control the URL or the content, only a theoretical threat exists. The website owner of the site where the URL points could theoretically execute an XSS attack against the site that uses the vulnerable jQuery version in the mentioned way.
The second issue (https://bugs.jquery.com/ticket/11974) can only be exploited if the website uses the function $.parseHTML() and you can influence the input to that function. If it does not use the function in the described way, you cannot exploit the issue.
To wrap things up:
If you see the message "Vulnerable version of the library jquery" you will have to look at the JavaScript code that is actually used by the website and identify if it uses the vulnerable functions in a way that can be exploited by you. If it doesn't, you cannot create a proof of concept exploit or exploit the vulnerability.
Further to Denis's excellent answer it is also worth clarifying that an attacker needs to be able to control the inputs to the vulnerable functions when a "victim's" machine is visiting the site.
If, for example, there is a textbox on a webpage and when the user hits "Submit" the contents of that textbox is used as an argument to the $.get() function - that isn't an exploit per se, because the attacker is just executing the vulnerable function on their own machine.
A common attack scenario is a forum-style site where attackers can post content which is then rendered on other visitors' machines (e.g. you are currently reading my content rendered on your machine) - if part of the site's operation involves taking that content, or parts of that content, and passing it into vulnerable functions, then there you have a potential exploit.