Cross-Site Scripting Vulnerability in WorklogPRO Timesheets for Jira Plugin
CVE-2025-57681

5.4MEDIUM

Key Information:

Vendor

Atlassian
Status
WorklogPRO - Timesheets for Jira
Vendor
CVE Published:
21 January 2026

What is CVE-2025-57681?

The WorklogPRO Timesheets for Jira plugin is susceptible to a Cross-Site Scripting (XSS) vulnerability, enabling the injection of arbitrary HTML or JavaScript. This security flaw can be triggered by submitting a specially crafted payload into an issue's summary field, posing a significant risk of exposure for users interacting with the affected versions of the plugin.

References

https://marketplace.atlassian.com/apps/1212626/worklogpro...
https://thestarware.atlassian.net/wiki/spaces/WLP/pages/3...

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.