CVE-2019-10360: A stored cross site scripting vulnerability in Jenkins Maven Release Plugin 0.14.0 and earlier allowed atta...

Security readout for executives and security teams

Jenkins instances using Maven Release Plugin 0.14.0 or earlier could store attacker-supplied HTML or JavaScript on plugin pages. A user viewing those pages could be exposed to script execution in the Jenkins web interface. The sources do not provide CVSS scoring or evidence of active exploitation. Exposure is limited to Jenkins deployments with Maven Release Plugin 0.14.0 or earlier installed. Risk depends on who can access affected plugin pages and whether untrusted users can influence stored content. Organizations without this plugin, or using versions outside the affected range, are not indicated as affected by the bundle. Treat this as a focused Jenkins hygiene issue, not a broad emergency. Prioritize Jenkins environments that expose plugin pages to many users or support privileged build and release workflows. Remediate through vendor guidance and reduce unnecessary plugin exposure. Mitigation focus: Check Jenkins plugin inventory for Maven Release Plugin version 0.14.0 or earlier.; Review the Jenkins advisory for vendor-approved remediation or upgrade guidance.; Disable or remove the plugin if it is not operationally required..

Prepared

Jun 6, 2026, 14:06 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.