CVE-2025-67824
Medium
Description
The WorklogPRO - Jira Timesheets plugin in the Jira Data Center before 4.24.2-jira9, 4.24.2-jira10 and 4.24.2-jira11 allows attackers to inject arbitrary HTML or JavaScript via XSS. This is exploited via a crafted payload placed in the name of a filter. This code is executed in the browser when the user attempts to create a timesheet with the filter timesheet type on the custom timesheet dialog because the filter name is not properly sanitized during the action.
SeverityMedium
CVSS6.1
Exploit probability—
ProductJira Timesheets plugin in the Jira Data Center
PublishedJan 20, 2026
First seenJan 20, 2026
Weakness typeCWE-79Cross-site scripting (XSS)
How to fix
Update
- WorklogPRO Jira Timesheets plugin in the Jira Data Center4.24.2-jira9, 4.24.2-jira10 and 4.24.2-jira11 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| WorklogPRO Jira Timesheets plugin in the Jira Data Center | No range specified | 4.24.2-jira9, 4.24.2-jira10 and 4.24.2-jira11 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.