The flaw resides in the Qualys Container Scanning Connector Plugin where user‑controlled values are injected directly into a JavaScript context without proper escaping. This constitutes a stored cross‑site scripting vulnerability that can be exploited by any attacker who can modify a build job. The vulnerability aligns with CWE‑79 and allows arbitrary client‑side code execution once the malicious payload is stored in a job configuration. An attacker with Item/Configure permission—commonly granted to build owners or developers—can create or alter a job to embed the script, then cause all users who subsequently view the job configuration to execute the code in their browsers. Potential consequences include theft of sensitive data from the victim’s session, injection of further malicious links, or compromise of credentials stored in the Jenkins web interface.

Jenkins Qualys Container Scanning Connector Plugin versions 1.8.0.5 and all earlier releases are vulnerable. Any Jenkins instance that has these plugin versions installed and is accessible to users with Item/Configure permission is affected. The plugin is a component of the Jenkins Project used for ingesting Qualys container scanning results.

Because the flaw is stored XSS, the malicious script remains on the server once injected and can affect every subsequent user who opens the job configuration. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, so current exploitation likelihood is uncertain. Nonetheless, the requirement of only Item/Configure permission, which is frequently granted in many Jenkins environments, combined with the persistent nature of the store makes this a high‑potential risk. The CVSS score of 5.4 indicates moderate severity but does not diminish the potential impact of this persistent cross‑site scripting.