CVE-2026-92134

Summary

The flaw allows attackers to inject malicious JavaScript through the Jenkins Warnings Plugin, leading to a stored cross-site scripting (XSS) vulnerability.

Exploitability

Exploitation is relatively straightforward for attackers with Item/Configure permission, as they can use a javascript: scheme URL to inject malicious content.

Blast radius

If exploited, the vulnerability could affect any user who visits a page containing the injected content, potentially leading to data theft or further compromise.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Jenkins Warnings Plugin 13.10258.va_17d49a_78c3b_ or later.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.