Researchers say tens of thousands of sites are using JavaScript libraries that are years old and contain publicly known vulnerabilities.