CoreCVE
Back

MEDIUM

Jenkins update-center2 3.18.3 and earlier does not escape plugin-provided values (plugin names, descriptions, and version metadata) on plugin download index pages, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to provide a plugin for hosting

Published Sep 2, 2026

Description

Jenkins update-center2 3.18.3 and earlier does not escape plugin-provided values (plugin names, descriptions, and version metadata) on plugin download index pages, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to provide a plugin for hosting.

Affected products

Remediation

No remediation recorded yet.

Metrics

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (1)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner jenkins
Published Sep 2, 2026
Updated Sep 2, 2026
Reserved Sep 1, 2026
Link CVE-2026-84677
CISA Vulnrichment
Updated Sep 2, 2026
NVD
Status Awaiting Analysis
Modified Sep 3, 2026
Link CVE-2026-84677
Red Hat
Severity n/a
Public date n/a
Links CVE-2026-84677