PT-2026-3781 · Thestarware · Worklogpro

Published 2026-01-21 · Updated 2026-02-02 · CVE-2025-57681

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions WorklogPRO - Timesheets for Jira versions prior to 4.23.6-jira10 WorklogPRO - Timesheets for Jira versions prior to 4.23.5-jira9

Description The WorklogPRO - Timesheets for Jira plugin contains a flaw that allows the injection of arbitrary HTML or JavaScript code. This is a Cross-Site Scripting (XSS) issue, where a malicious payload placed within an issue's summary field can be exploited. The vulnerability can be leveraged by both users and attackers. The vulnerable parameter is the summary field.

Recommendations Upgrade WorklogPRO - Timesheets for Jira to version 4.23.6-jira10 or later. Upgrade WorklogPRO - Timesheets for Jira to version 4.23.5-jira9 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-57681

Affected Products

Worklogpro

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-57681 · Security Note
• https://osv.dev/vulnerability/CVE-2025-57681 · Vendor Advisory
• https://thestarware.atlassian.net/wiki/spaces/WLP/pages/3326574597/Security+Advisory+CVE-2025-57681+-+Stored+XSS+in+WorklogPRO+DC · Vendor Advisory
• https://t.me/cveNotify/150620 · Telegram Post
• https://marketplace.atlassian.com/apps/1212626/worklogpro-timesheets-for-jira/version-history · Note