Jenkins Html Publisher Plugin
Monthly
Stored cross-site scripting in Jenkins HTML Publisher Plugin (versions 427 and earlier) lets an attacker with Item/Configure permission inject JavaScript via an unescaped job name and URL written into the legacy wrapper file, which then executes in the browser of any user who later views the published report. There is no public exploit identified at time of analysis and EPSS is very low (0.04%, 12th percentile), but the SSVC technical impact is rated total, meaning a successful payload can fully compromise a victim session such as an administrator's.
Stored cross-site scripting in Jenkins HTML Publisher Plugin (versions 427 and earlier) lets an attacker with Item/Configure permission inject JavaScript via an unescaped job name and URL written into the legacy wrapper file, which then executes in the browser of any user who later views the published report. There is no public exploit identified at time of analysis and EPSS is very low (0.04%, 12th percentile), but the SSVC technical impact is rated total, meaning a successful payload can fully compromise a victim session such as an administrator's.