Jenkins Project Jenkins Coverage Plugin vulnerabilities
🔔 Create alert RSS Version checker
Published CVEs affecting Jenkins Project Jenkins Coverage Plugin: 2 record(s), with affected versions and fixes.
CVE-2026-92135
High · 8.0
CWE-79 Sep 16, 2026
Cross-site Scripting (XSS) in Jenkins Project Jenkins Coverage Plugin
Jenkins Coverage Plugin 3.3358.v9487dde48783 and earlier does not validate the coverage results ID when a job configuration is submitted through the REST API, allowing attackers with Item/Configure permission to use a javascript: scheme URL as identifier, resulting in a stored cross-site scripting (XSS) vulnerability.
CVE-2025-67641
Medium · 5.4
CWE-79 Dec 10, 2025
Jenkins Coverage Plugin has a stored cross-site scripting (XSS) vulnerability
Jenkins Coverage Plugin 2.3054.ve1ff7b_a_a_123b_ and earlier does not validate the configured coverage results ID when creating coverage results, only when submitting the job configuration through the UI, allowing attackers with Item/Configure permission to use a `javascript:` scheme URL as identifier by configuring the job through the REST API, resulting in a stored cross-site scripting (XSS) vulnerability.