XSS could be injected in graphs on tracker plugin using URL parameters or an artefact.
Impact
An attacker could use this vulnerability to force a victim to execute uncontrolled code.
CVSS2 score : 4 (AV:N/AC:L/Au:S/C:N/I:P/A:N)
Exploitation
Create a report on a artifact with name containing something like <script>alert(1)</script>.
Edit a report with a name containing something like <script>alert(2)</script>.
References
https://cwe.mitre.org/data/definitions/79.html
https://www.owasp.org/index.php/Cross-site_Scripting_%28XSS%29