https://order.fiveguys.it/js/jquery-validation-defaults.js?v=ouWE1depboeMQejMg5cRU_fqCQc

1/*
2 * OT-13757 - enable the jquery-validation XSS mitigation.
3 *
4 * jquery-validation >= 1.20.0 fixes the showLabel() XSS (CVE-2025-3573,
5 * GHSA-rrj2-ph5q-jxw2), but the fix is OPT-IN: "escapeHtml" is deliberately
6 * absent from the library's own defaults for backwards compatibility, so
7 * showLabel() still does
8 *
9 *     error.html( message )
10 *
11 * unless settings.escapeHtml is truthy (see jquery.validate.js showLabel).
12 * Upgrading the shipped asset alone therefore does NOT close the vulnerability
13 * - this file is the other half of the fix and must load after
14 * jquery.validate.min.js on every page that loads it.
15 *
16 * Safe to enable: a scan of all 6813 locale resources found ZERO validation
17 * messages containing markup, so switching from .html() to .text() changes no
18 * rendered output. jquery-validation-unobtrusive picks this up automatically -
19 * validate() merges $.validator.defaults into each form's settings.
20 */
21(function () {
22    'use strict';
23
24    if (!window.jQuery || !window.jQuery.validator || typeof window.jQuery.validator.setDefaults !== 'function') {
25        // jquery-validation is not on this page (or loaded out of order) - nothing to harden.
26        return;
27    }
28
29    window.jQuery.validator.setDefaults({ escapeHtml: true });
30})();