Jenkins Applitools Eyes Plugin vulnerable to XSS through its Build page

Jenkins Applitools Eyes Plugin 1.16.5 and earlier does not escape the Applitools URL on the build page. This results in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure permission. Applitools Eyes Plugin 1.16.6 rejects Applitools URLs that contain HTML...

CVE-2025-53743

Jenkins Applitools Eyes Plugin 1.16.5 and earlier does not mask Applitools API keys displayed on the job configuration form, increasing the potential for attackers to observe and capture them...

CVE-2025-53658

CVE-2025-53658 affects Jenkins Applitools Eyes Plugin (versions 1.16.5 and earlier). The vulnerability is a stored XSS on the build page caused by not escaping the Applitools URL, exploitable by attackers with Item/Configure permission. The issue is confirmed across multiple sources (including Je...