Jenkins HTML Publisher Plugin versions 427 and earlier do not escape the job name and job URL in the legacy wrapper file, enabling a stored cross‑site scripting flaw. When an attacker with Item/Configure permission injects malicious script into a job, the script is persisted and later rendered to any user who views the job’s HTML report. This can lead to theft of session cookies, credential exfiltration, or arbitrary client‑side action.

The vulnerability affects Jenkins Project’s HTML Publisher Plugin up to and including version 427. No newer versions are listed as vulnerable.

This flaw is a high‑severity stored XSS, and although no EPSS score or KEV listing is available, the required attacker privilege (Item/Configure) is common in many build configurations. The CVSS score of 8 indicates high severity, reinforcing the risk posed to installations that still run the affected plugin, while the practical impact and ease of exploitation imply a significant threat to any installation that still runs the affected plugin.