CVE-2022-27196: Jenkins Favorite

Medium severity, CVSS 5.4. EPSS: 0.8% chance of exploitation in the next 30 days.

Jenkins Favorite Plugin 2.4.0 and earlier does not escape the names of jobs in the favorite column, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure or Item/Create permissions.

Affected products

• Jenkins Favorite: before 2.4.1 (fixed in 2.4.1)

Published 2022-03-15. Last modified 2026-06-17.