CVE-2020-2225: Jenkins Matrix Project

Medium severity, CVSS 5.4. EPSS: 1% chance of exploitation in the next 30 days.

Jenkins Matrix Project Plugin 1.16 and earlier does not escape the axis names shown in tooltips on the overview page of builds with multiple axes, resulting in a stored cross-site scripting vulnerability.

Affected products

• Jenkins Matrix Project: up to and including 1.16

Published 2020-07-15. Last modified 2026-06-17.