Ghostwire
Home / Vulnerabilities / CVE-2026-42524

CVE-2026-42524: Jenkins HTML Publisher Plugin 427 and earlier does not escape job name and URL in the legacy wrapper file, resulting in...

HIGH CVSS 7.5

Published: April 29, 2026 | Last Modified: April 29, 2026

Description

Jenkins HTML Publisher Plugin 427 and earlier does not escape job name and URL in the legacy wrapper file, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

Ghostwire Analysis — What This Means Practically

This analysis is generated by Ghostwire from NVD, CISA KEV, EPSS, and open-source intelligence data. Verify findings through primary sources before acting.

Security Coverage (2 articles)

Tenable CVEs
CVE-2026-42524
 CVE Feed
CVE-2026-42524 - Jenkins HTML Publisher Plugin Stored XSS Vulnerability

References