CVE-2025-57681

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-01-21 · updated 2026-06-17
Weakness: CWE-79

Description

The WorklogPRO - Timesheets for Jira plugin in Jira Data Center before version 4.23.6-jira10 and before version 4.23.5-jira9 allows users and attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability. The vulnerability is exploited via a specially crafted payload placed in an issue's summary field

Affected products

Thestarware Worklogpro: before 4.23.7 — fixed in 4.23.7

How to fix

Upgrade to a fixed version: Thestarware Worklogpro 4.23.7. Check the vendor advisory for mitigations.

References

https://marketplace.atlassian.com/apps/1212626/worklogpro-timesheets-for-jira/version-history
https://thestarware.atlassian.net/wiki/spaces/WLP/pages/3326574597/Security+Advisory+CVE-2025-57681+-+Stored+XSS+in+WorklogPRO+DC

Get alerted when CVE-2025-57681 or the next vulnerability affects your stack