CVE-2021-21619: Jenkins Claim

Medium severity, CVSS 5.4. EPSS: 9.4% chance of exploitation in the next 30 days.

Jenkins Claim Plugin 2.18.1 and earlier does not escape the user display name, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers who are able to control the display names of Jenkins users, either via the security realm, or directly inside Jenkins.

Affected products

• Jenkins Claim: up to and including 2.18.1

Published 2021-02-24. Last modified 2026-06-17.