As described by multiple users in stack-overflow

https://stackoverflow.com/questions/63604874/jenkins-cors-plugin-not-enabling-access-control-allow-header

https://stackoverflow.com/questions/56962278/jenkins-cors-filter-plugin-not-adding-access-control-allow-origins-header

It seems like the CORS plugin doesn't work anymore. I ran into the same issue, tried solving it from all kinds of directions but I think it still broken.

If this could be fixed, that's amazing. But if it's not being maintained maybe it's possible to add a warning to the plugin page?