Jenkins Applitools Eyes Plugin vulnerable to XSS through its Build page

Jenkins Applitools Eyes Plugin 1.16.5 and earlier does not escape the Applitools URL on the build page. This results in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure permission. Applitools Eyes Plugin 1.16.6 rejects Applitools URLs that contain HTML...

CVE-2025-53743

Jenkins Applitools Eyes Plugin 1.16.5 and earlier does not mask Applitools API keys displayed on the job configuration form, increasing the potential for attackers to observe and capture them...

CVE-2025-53658

The Jenkins Applitools Eyes Plugin (version 1.16.5 and earlier ) is vulnerable to a stored cross-site scripting (XSS) vulnerability because it fails to escape the Applitools URL on the build page. Attackers with Item/Configure permissions can exploit this to inject and execute malicious scripts. ...