A big question and also a reason why loads of sites with JQuery (versions installed when the functionality was introduced on a website, often website origin date :o) . This site has now been cleansed: http://killmalware.com/kcrockyhorror.com/#
and was hacked some 12 days ago. http://kcrockyhorror.com/wp-includes/js/jquery/jquery.js?ver=1.11.2
http://kcrockyhorror.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=1.2.1
http://kcrockyhorror.com/wp-content/plugins/random-image-gallery-with-pretty-photo-zoom/js/jquery.prettyPhoto.js?ver=4.2.2
http://kcrockyhorror.com/wp-content/plugins/revslider/rs-plugin/js/jquery.themepunch.revolution.min.js?ver=4.2.2
http://kcrockyhorror.com/wp-content/plugins/wp-easy-gallery/js/jquery.prettyPhoto.js?ver=4.2.2
http://kcrockyhorror.com/wp-content/plugins/wp-easy-gallery/js/EasyGalleryLoader.js?ver=4.2.2
http://kcrockyhorror.com/wp-content/plugins/cforms146/js/cforms.js
http://s0.wp.com/wp-content/js/devicepx-jetpack.js?ver=201528
http://s.gravatar.com/js/gprofiles.js?ver=2015Julaa
http://kcrockyhorror.com/wp-content/plugins/jetpack/modules/wpgroho.js?ver=4.2.2
http://kcrockyhorror.com/wp-includes/js/jquery/ui/core.min.js?ver=1.11.4
http://kcrockyhorror.com/wp-includes/js/jquery/ui/widget.min.js?ver=1.11.4
http://kcrockyhorror.com/wp-includes/js/jquery/ui/mouse.min.js?ver=1.11.4
http://kcrockyhorror.com/wp-includes/js/jquery/ui/sortable.min.js?ver=1.11.4
http://kcrockyhorror.com/wp-includes/js/jquery/ui/tabs.min.js?ver=1.11.4
http://kcrockyhorror.com/wp-includes/js/jquery/ui/accordion.min.js?ver=1.11.4
http://kcrockyhorror.com/wp-content/themes/kora/js/fancybox/jquery.fancybox-1.3.4.js?ver=1.0.4
http://kcrockyhorror.com/wp-content/themes/kora/js/sliders/responsiveslides.js?ver=1.0.4
http://kcrockyhorror.com/wp-content/themes/kora/js/sliders/jquery.jcarousel.min.js?ver=1.0.4
http://kcrockyhorror.com/wp-content/themes/kora/js/jquery.sticky.js?ver=1.0.4
http://kcrockyhorror.com/wp-content/themes/kora/js/jquery.isotope.min.js?ver=1.0.4
http://kcrockyhorror.com/wp-content/themes/kora/js/jquery.hoverdir.js?ver=1.0.4
http://kcrockyhorror.com/wp-content/themes/kora/js/mfn-menu.js?ver=1.0.4
http://kcrockyhorror.com/wp-includes/js/jquery/jquery.form.min.js?ver=3.37.0
http://kcrockyhorror.com/wp-content/themes/kora/js/scripts.js?ver=1.0.4
http://kcrockyhorror.com/wp-includes/js/comment-reply.min.js?ver=4.2.2
http://stats.wp.com/e-201528.js
See 2 vulnerable detected like here: http://retire.insecurity.today/#!/scan/8a2826d1f54e702c5f420e9ab696cc4226d4e1d3227e63ebc42a8328d5ea25ff
On this site this is vulnerable, read: https://wordpress.org/support/topic/jquery-migrate-vulnerability-or-false-alarm
Kora theme vulnerable: http://forum.muffingroup.com/kora/discussion/476/theme-mail-php-vulnerable/p1
Also see the tracker tracker report attached (widget tracking mainly)
polonus