What’s Vulnerable › Vulnerabilities

CVE-2025-67824

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-01-20 · updated 2026-06-17
• Weakness: CWE-79

Description

The WorklogPRO - Jira Timesheets plugin in the Jira Data Center before 4.24.2-jira9, 4.24.2-jira10 and 4.24.2-jira11 allows attackers to inject arbitrary HTML or JavaScript via XSS. This is exploited via a crafted payload placed in the name of a filter. This code is executed in the browser when the user attempts to create a timesheet with the filter timesheet type on the custom timesheet dialog because the filter name is not properly sanitized during the action.

References

• https://marketplace.atlassian.com/apps/1212626/worklogpro-timesheets-for-jira/version-history
• https://thestarware.atlassian.net/wiki/x/CAAdyg

Get alerted when CVE-2025-67824 or the next vulnerability affects your stack