Jenkins Applitools Eyes Plugin vulnerable to XSS through its Build page

Jenkins Applitools Eyes Plugin 1.16.5 and earlier does not escape the Applitools URL on the build page. This results in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure permission. Applitools Eyes Plugin 1.16.6 rejects Applitools URLs that contain HTML...

CVE-2025-53743

Jenkins Applitools Eyes Plugin 1.16.5 and earlier does not mask Applitools API keys displayed on the job configuration form, increasing the potential for attackers to observe and capture them...

CVE-2025-53658

The Jenkins Applitools Eyes Plugin (version 1.16.5 and earlier ) is vulnerable to stored cross-site scripting (XSS) because it fails to escape the Applitools URL on the build page. An attacker with Item/Configure permissions can inject malicious scripts into this field, which are then executed in...