PT-2026-3630 · Atlassian · Worklogpro - Jira Timesheets Plugin

Published 2026-01-20 · Updated 2026-01-21 · CVE-2025-67824

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions WorklogPRO - Jira Timesheets plugin versions prior to 4.24.1-jira9 WorklogPRO - Jira Timesheets plugin versions prior to 4.24.1-jira10 WorklogPRO - Jira Timesheets plugin versions prior to 4.24.1-jira11

Description The WorklogPRO - Jira Timesheets plugin for Jira Data Center is susceptible to cross-site scripting (XSS). An attacker can inject arbitrary HTML or JavaScript code by crafting a malicious payload within the name of a filter. This payload is executed in the user's browser when creating a timesheet with the filter timesheet type on the custom timesheet dialog, as the filter name is not properly sanitized. The vulnerability occurs because the filter name is not properly sanitized during the action.

Recommendations Update WorklogPRO - Jira Timesheets plugin to version 4.24.1-jira9 or later. Update WorklogPRO - Jira Timesheets plugin to version 4.24.1-jira10 or later. Update WorklogPRO - Jira Timesheets plugin to version 4.24.1-jira11 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-67824

Affected Products

Worklogpro - Jira Timesheets Plugin

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-67824 · Security Note
• https://twitter.com/CVEnew/status/2013641585129353725 · Twitter Post
• https://marketplace.atlassian.com/apps/1212626/worklogpro-timesheets-for-jira/version-history · Note
• https://twitter.com/VulmonFeeds/status/2013715959140258135 · Twitter Post
• https://thestarware.atlassian.net/wiki/x/CAAdyg · Note
• https://thestarware.atlassian.net/wiki/spaces/WLP/pages/3326574597/Security+Advisory+CVE-2025-57681+-+Stored+XSS+in+WorklogPRO+DC · Note
• https://t.me/cveNotify/149370 · Telegram Post