Maybe related to recent security revisions in Jenkins core, is that the job description provided by the Stash-pullrequest-builder-plugin (I guess) is posted as verbatim HTML markup of the a-href tag with URL to PR web-interface enclosing the title of the PR. This HTML markup ends up seen in both the Jenkins interface (list of built jobs on the left) and in the Stash Notifications plugin reports posted back to Stash (not the PR comments written by Stash-pullrequest-builder-plugin, but the "X builds failed" summary and the popup that details it in Stash web-gui).

From suggestions in issue search, this may be related to JENKINS-22028, and if so - maybe the fix is to update documentation (Wiki page for the plugin).