CVE-2022-34783: Jenkins Plot Plugin stored XSS via unescaped plot descriptions

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

medium priorityRequires authenticated Item/Configure permission and victim interaction, but the stored XSS can affect other users and EPSS is very high.

What it is

Jenkins Plot Plugin 2.1.10 and earlier does not escape plot descriptions, creating a stored cross-site scripting flaw. An attacker with Item/Configure permission can persist script that executes in the browsers of users viewing the affected plot.

Impact

An attacker can run arbitrary script in a victim's Jenkins session, potentially stealing session data or performing actions as the victim. The scope change in the CVSS vector reflects that the injected script can affect resources beyond the vulnerable component.

Attack surface

Reached over the network through the Jenkins web interface; the attacker needs Item/Configure permission, and exploitation requires a victim to view the crafted plot, so user interaction is required.

Exploitation

Not listed in CISA KEV and no public exploit references are provided, but EPSS is very high at 0.814 (99.6th percentile), indicating elevated likelihood of exploitation activity.

What to do

• Upgrade Jenkins Plot Plugin to a version later than 2.1.10 that escapes plot descriptions.
• Restrict Item/Configure permission to trusted users only.
• Review existing plot descriptions for injected script content and remove anything suspicious.
• Apply Jenkins hardening guidance and keep the core and all plugins current.

Detection

• Search Jenkins job and plot configuration data for script tags or event handler attributes in plot descriptions.
• Monitor Jenkins audit logs for Item/Configure changes made by unexpected accounts.
• Alert on suspicious script execution or outbound requests originating from Jenkins user sessions.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.