Rule Definition
While some known vulnerabilities lead to only minor impacts, some of the largest breaches to date have relied on exploiting known vulnerabilities in components. Depending on the assets you are protecting, perhaps this risk should be at the top of the list. jQuery 1.4.2 allows remote attackers to conduct cross-site scripting (XSS) attacks via vectors related to use of the text method inside after. This rule has been listed as CVE-2014-6071 in the CVE registry.

Remediation
Do not use append(), after() or upgrade the version of jQuery

Violation Code Sample

<script src="https://code.jquery.com/jquery-1.4.2.js"></script> 
  <script>
    $(function() {
      $('#users').each(function() {
        var select = $(this);
        var option = select.children('option').first();
        select.after(option.text()); // VULNERABILITY
        select.hide();
      });
    });
  </script>

Fixed Code Sample

<script src="https://code.jquery.com/jquery-1.6.0.js"></script> 
  <script>
    $(function() {
      $('#users').each(function() {
        var select = $(this);
        var option = select.children('option').first();
        select.after(option.text()); // NO VULNERABILITY
        select.hide();
      });
    });
  </script>

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6071