CVE-2022-34786: Jenkins Rich Text Publisher

Medium severity, CVSS 5.4. EPSS: 0.6% chance of exploitation in the next 30 days.

Jenkins Rich Text Publisher Plugin 1.4 and earlier does not escape the HTML message set by its post-build step, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to configure jobs.

Affected products

• Jenkins Rich Text Publisher: up to and including 1.4

Published 2022-06-30. Last modified 2026-06-17.