CVE-2018-1999029: Jenkins Shelve Project

Medium severity, CVSS 5.4. EPSS: 0.7% chance of exploitation in the next 30 days.

A cross-site scripting vulnerability exists in Jenkins Shelve Project Plugin 1.5 and earlier in ShelveProjectAction/index.jelly, ShelvedProjectsAction/index.jelly that allows attackers with Job/Configure permission to define JavaScript that would be executed in another user's browser when that other user performs some UI actions.

Affected products

• Jenkins Shelve Project: up to and including 1.5

Published 2018-08-01. Last modified 2026-06-17.