One important distinction to make here is that only because the jQuery library contains known vulnerabilities, it does not mean that the website is vulnerable to the contained vulnerability.
As with many libraries, a website using jQuery will only be affected by a vulnerability if it uses the vulnerable function in a vulnerable way. If it does not use the functionality at all, the issues will not be exploitable. They might become exploitable if the used functionality on the website changes.
Looking for example at the mentioned jQuery 2.1.1. This version is, according to the site http://research.insecurelabs.org/jquery/test/ vulnerable to
- jQuery issue 2432 - 3rd party
$.get() auto executes if content type is
- jQuery issue 11974 -
parseHTML executes inline scripts like event handlers
The first issue (https://github.com/jquery/jquery/issues/2432) can be exploited only if the vulnerable site uses
$.get() for a URL that returns a response that can be influenced by you. If you cannot control the URL or the content, only a theoretical threat exists. The website owner of the site where the URL points could theoretically execute an XSS attack against the site that uses the vulnerable jQuery version in the mentioned way.
The second issue (https://bugs.jquery.com/ticket/11974) can only be exploited if the website uses the function
$.parseHTML() and you can influence the input to that function. If it does not use the function in the described way, you cannot exploit the issue.
To wrap things up: