CVE-2026-84677

Jenkins update-center2 3.18.3 and earlier does not escape plugin-provided values plugin names, descriptions, and version metadata on plugin download index pages, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers able to provide a plugin for hosting...