CVE-2018-1000604 — A persisted cross-site scripting vulnerability exists in Jenkins Badge Plugin 1.4 and earlier in BadgeSummaryAction.java, HtmlBadgeAction.java that allows attackers able to control build badge content to define JavaScript that would be executed in another user's browser when that other user performs some UI actions

Back Back to CVE browser

MEDIUM

A persisted cross-site scripting vulnerability exists in Jenkins Badge Plugin 1.4 and earlier in BadgeSummaryAction.java, HtmlBadgeAction.java that allows attackers able to control build badge content to define JavaScript that would be executed in another user's browser when that other user performs some UI actions

Published Jun 26, 2018

5.4

MEDIUM

CVSS 3.0

EPSS 0.70%

Description

A persisted cross-site scripting vulnerability exists in Jenkins Badge Plugin 1.4 and earlier in BadgeSummaryAction.java, HtmlBadgeAction.java that allows attackers able to control build badge content to define JavaScript that would be executed in another user's browser when that other user performs some UI actions.

Affected products

Remediation

No remediation recorded yet.

Metrics

0.70% 0.00704

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 3, 2026.

EPSS probability 0.00704

Score over time

2021–2026

EPSS v1
EPSS v5
EPSS v2
EPSS v3

Percentile over time

EPSS v1
EPSS v5
EPSS v2
EPSS v3

Table of values (10 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 3, 2026	0.70% (0.00704)	51.67th	v5 (v2026.06.15)
Sep 20, 2026	0.70% (0.00704)	51.86th	v5 (v2026.06.15)
Jul 20, 2024	0.05% (0.00054)	22.53th	v3 (v2023.03.01)
Apr 25, 2024	0.05% (0.00054)	20.76th	v3 (v2023.03.01)
Feb 8, 2024	0.05% (0.00053)	17.93th	v3 (v2023.03.01)
Mar 7, 2023	0.05% (0.00054)	20.04th	v3 (v2023.03.01)
Mar 6, 2023	0.89% (0.00885)	27.89th	v2 (v2022.01.01)
Feb 4, 2022	0.89% (0.00885)	10.50th	v2 (v2022.01.01)
Feb 3, 2022	0.44% (0.00442)	10.76th	v5 (v2026.06.15)
Apr 14, 2021	0.44% (0.00442)	0.00th	v1

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (4)

https://github.com/advisories/GHSA-3xjq-8j89-xrw9
Advisory
https://github.com/jenkinsci/badge-plugin/commit/63a7744cef33338e62898576a50bcc521d76ba9f
https://jenkins.io/security/advisory/2018-06-25/#SECURITY-906
x_refsource_CONFIRMVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2018-1000604

Link	Providers	Tags
https://github.com/advisories/GHSA-3xjq-8j89-xrw9		Advisory
https://github.com/jenkinsci/badge-plugin/commit/63a7744cef33338e62898576a50bcc521d76ba9f
https://jenkins.io/security/advisory/2018-06-25/#SECURITY-906		x_refsource_CONFIRMVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2018-1000604