description: Jenkins Matrix Project Plugin 1.16 and earlier does not escape the axis names shown in tooltips on the overview page of builds with multiple axes, resulting in a stored cross-site scripting vulnerability.
affected:
{
product: Jenkins Matrix Project Plugin
vendor: Jenkins project
versions:
lessThanOrEqual: 1.16, status: affected, version: unspecified, versionType: custom
}