Description
The WorklogPRO - Jira Timesheets plugin in the Jira Data Center before 4.24.2-jira9, 4.24.2-jira10 and 4.24.2-jira11 allows attackers to inject arbitrary HTML or JavaScript via XSS. This is exploited via a crafted payload placed in the name of a filter. This code is executed in the browser when the user attempts to create a timesheet with the filter timesheet type on the custom timesheet dialog because the filter name is not properly sanitized during the action.
References (2)
Core 2
Core References
Various Sources
https://marketplace.atlassian.com/apps/1212626/worklogpro-timesheets-for-jira/version-history
Third Party Advisory
https://thestarware.atlassian.net/wiki/x/CAAdyg
Scores
CVSS v3
6.1
EPSS
0.0021
EPSS Percentile
11.2%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
no
Technical Impact
partial
Details
CWE
CWE-79
Status
published
Published
Jan 20, 2026
Tracked Since
Feb 18, 2026