CVE-2022-27207: Jenkins Global-Build-Stats

Medium severity, CVSS 4.8. EPSS: 0.8% chance of exploitation in the next 30 days.

Jenkins global-build-stats Plugin 1.5 and earlier does not escape multiple fields in the chart configuration on the 'Global Build Stats' page, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Overall/Administer permission.

Affected products

• Jenkins Global-Build-Stats: up to and including 1.5

Published 2022-03-15. Last modified 2026-06-17.