As the commentators suggested you correctly, you will need to use the HttpOnly fla as a solution. But I just want to add a note regarding the right comments you received about HttpOnly flag.
In fact, if a client of your website uses a Mozilla Firefox browser of version before 3.0.6 (Bug 380418: XMLHttpRequest allows reading HTTPOnly cookies) and/or SeaMonkey browser of version before 1.1.15 (Rough Changelog for SeaMonkey 1.1.4) the HttpOnly won't be helpful because this flag won't be able to remove cookie information from the response headers in
It should also be noted that even though the scripts can't see your users' cookies (if using HttpOnly), they can still see the entire DOM (web page contents) and can submit requests on the user's behalf. The browser will automatically include the cookies with each request to your server, even though the script sending the request can't see the cookies. From the server's perspective, this is identical to the user taking the action themselves.
Including third party scripts is dangerous! Don't do it unless you sincerely trust the source of the script. Any third-party script you include on your page is, from a security standpoint, continuously in the position of having a successful XSS (Cross-Site Scripting) exploit on your users... and it's up to them what to do with it.
Even if the source of the script doesn't act maliciously, they can still wreck your site quite literally by accident if there's an error in the script or a server goes away or something. For example, consider that time Facebook broke the web because the script that puts their
Like button on a page malfunctioned.
You can mitigate this risk somewhat by hosting scripts yourself, but sometimes that's not an option, or sometimes the script itself pulls in external resources.