I once worked with a company that started using one of these. They said our "vulnerability scores" were significantly too high.
I looked at the report, turns out they were just looking at HTTP headers and throwing up every CVE that matched any version numbers they found. (One of the "worst offenders" on the system was a CVE about a vulnerability in PHP when using "magic quotes", a part of PHP that hadn't been used in many years, and our application never used)
We were officially instructed that the fix would be to hide the PHP and apache version numbers from the headers.
If I were the one running that scan, and someone "fixed" the problem by just hiding the version numbers, I'd be calling for that person to be fired for trying to hide the problem. But here they were instructing us to do just that. And once we did, the system was marked "secure"...
My feeling is similar to when I started unit testing aggressively a decade ago: it seems like this should be unnecessary, but every time I do it it never fails to pay dividends.
There were fraudulent credit card donations for $1 which became really obvious when the zip code was garbage.
The “solution” was to disabled the credit card page until the month of the fund raising event when it was enabled again in hopes of the scammers would not try during that month.
For example, recently a bunch of ReDOS voulns were reported in popular libraries. None of which were in code paths hit by our configurations.
So needless to say, I think this is a sensationalist headline.
Of course some of these site would not actually be vulnerable, but I would bet the vast majority of them don't even know they're using a library with a known vulnerability.
Also, this is nothing new on the web, the amount of wordpress sites with known voulns is probably MUCH higher.
Their wording means "we checked X sites and 77% of them met some criteria", which can be extrapolated to higher values of X (assuming the proper statistical care is taken, etc).
Your wording implies the same, but that's not good because you can't extrapolate to a larger X. You chose the sites after knowing they already met the criteria, and that changes the meaning.
Which technically means "vulnerabilities", but depends on how it's used.
Does that even matter? No Front-End JS Library should actually make your backend vulnerable.
Otherwise you can throw your fancy anti-XSS on the frontend in the bin.
Also CSP helps.
FUD. Most SPAs keep the authentication token accessible to JavaScript so it can be sent to the API server. And XSS in the FE JS can permit an attacker to steal the user's authentication token and then the attacker could impersonate the user and take any action as the user.
Anywhere you take or show input from the user (an input box, a URL query, displaying data stored by some other system on the DB, etc...) could be a vector for an XSS attack.
And it's not just data passed to JS, but data passed to HTML or any data that could make it's way into CSS in many cases!