Jenkins Matrix Project Plugin 1.16 and earlier does not escape the axis names shown in tooltips on the overview page of builds with multiple axes, resulting in a stored cross-site scripting vulnerability.
org.jenkins-ci.plugins:matrix-project
{ "last_known_affected_version_range": "<= 1.16" }