The Jenkins Summary Display Plugin fails to escape job names in a JavaScript context on build report pages, allowing a stored cross‑site scripting vulnerability. An attacker with Item/Create or Item/Configure permission can inject malicious script into a job name; the script is persisted and executed whenever anyone views the affected build report. The result is arbitrary JavaScript execution in the victim’s browser, which can lead to session hijacking, credential theft, or defacement. The vulnerability is a stored XSS, affecting confidentiality, integrity, and potentially availability of the web interface.

The vulnerability affects the Jenkins Project's Jenkins Summary Display Plugin version 1.15 and earlier. Users running this plugin on any hosted Jenkins instance are susceptible.

With no EPSS score provided and the vulnerability not listed in the CISA KEV catalog, the CVSS score of 5.4 indicates moderate severity typical of stored XSS. The attack vector requires the attacker to have Item/Create or Item/Configure permissions, which are commonly granted to developers or CI administrators. Once achieved, the attacker can store a payload that will run in the context of any browser that visits the build report page, giving the attacker malicious code execution authority. Because the flaw is stored and does not require user interaction beyond viewing the page, the exploitation potential is significant if privileged users are compromised or mistakenly trusted.