Zero-day in popular jQuery plugin actively exploited for at least three years