See where it is being detected → Script loaded: http://aidmi.org/js/image_fadeinout/jquery.cycle.lite.1.0.min.js
No sources and sinks: http://www.domxssscanner.com/scan?url=http%3A%2F%2Faidmi.org%2Fjs%2Fimage_fadeinout%2Fjquery.cycle.lite.1.0.min.js
→ http://malsup.com/jquery/cycle/lite/
The code that is there has: jQuery Cycle Lite Plugin * -http://malsup.com/jquery/cycle/lite/ * Copyright (c) 2008 M. Alsup * Version: 1.0 (06/08/2008) * Dual licensed under the MIT and GPL licenses: * -http://www.opensource.org/licenses/mit-license.php * -http://www.gnu.org/licenses/gpl.html * Requires: jQuery v1.2.3 or later
while the “later” has
- jQuery Cycle Lite Plugin * -http://malsup.com/jquery/cycle/lite/ * Copyright (c) 2008-2012 M. Alsup * Version: 1.7 (20-FEB-2013) * Dual licensed under the MIT and GPL licenses: * http://www.opensource.org/licenses/mit-license.php * http://www.gnu.org/licenses/gpl.html * Requires: jQuery v1.3.2 or later
So we definitely have two different versions here and the older version at aidmi dot org should be mitigated.
polonus (volunteer website security analyst and website error-hunter)