CVE-2026-84677

Jenkins update-center2 version 3.18.3 and earlier fails to escape plugin-provided values—specifically plugin names, descriptions, and version metadata—on plugin download index pages, leading to a stored cross-site scripting (XSS) vulnerability. The attack requires an attacker to be able to provid...