CVE-2025-67824

MEDIUM

6.1

Description

The WorklogPRO - Jira Timesheets plugin in the Jira Data Center before 4.24.2-jira9, 4.24.2-jira10 and 4.24.2-jira11 allows attackers to inject arbitrary HTML or JavaScript via XSS. This is exploited via a crafted payload placed in the name of a filter. This code is executed in the browser when the user attempts to create a timesheet with the filter timesheet type on the custom timesheet dialog because the filter name is not properly sanitized during the action.

CVE Details

CVSS v3.1 Score6.1

SeverityMEDIUM

CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack VectorNETWORK

ComplexityLOW

Privileges RequiredNONE

User InteractionREQUIRED

Published1/20/2026

Last Modified1/26/2026

Sourcenvd

Honeypot Sightings0

Weaknesses (CWE)

CWE-79

References

https://marketplace.atlassian.com/apps/1212626/worklogpro-timesheets-for-jira/version-history(cve@mitre.org)

https://thestarware.atlassian.net/wiki/x/CAAdyg(cve@mitre.org)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.