Skip to content
Sign in
5.4 Medium

CVE-2025-53658 Jenkins Applitools Eyes Plugin 1.16.5 and earlier does not escape the Applitools URL on the build page, resulting in a…

Description

Jenkins Applitools Eyes Plugin 1.16.5 and earlier does not escape the Applitools URL on the build page, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

Affected products and versions

Product Affected versions Fixed in
Jenkins Applitools Eyes Plugin 1.16 earliest → 1.16.5 No fix stated

Other CVEs of Jenkins Applitools Eyes Plugin

The 3 CVEs of Jenkins Applitools Eyes Plugin →
CVE-2025-53743 Jenkins Applitools Eyes Plugin 1.16.5 and earlier does not mask Applitools API keys displayed on the job configuration… 5.3 Medium CVE-2025-53742 Jenkins Applitools Eyes Plugin 1.16.5 and earlier stores Applitools API keys unencrypted in job config.xml files on… 6.5 Medium
Track this CVE