CVE-2026-42524: Jenkins Html Publisher

High severity, CVSS 8.0. EPSS: 0.5% chance of exploitation in the next 30 days.

Jenkins HTML Publisher Plugin 427 and earlier does not escape job name and URL in the legacy wrapper file, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

Affected products

• Jenkins Html Publisher: up to and including 427

Published 2026-04-29. Last modified 2026-06-17.