Zero-day in popular jQuery plugin actively exploited for at least three years

A fix is out but the plugin is used in hundreds, if not thousands, of projects. Patching will take ages!