CVE-2025-57681: Thestarware Worklogpro

Medium severity, CVSS 5.4. EPSS: 0.2% chance of exploitation in the next 30 days.

The WorklogPRO - Timesheets for Jira plugin in Jira Data Center before version 4.23.6-jira10 and before version 4.23.5-jira9 allows users and attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability. The vulnerability is exploited via a specially crafted payload placed in an issue's summary field

Affected products

• Thestarware Worklogpro: before 4.23.7 (fixed in 4.23.7)

Published 2026-01-21. Last modified 2026-06-17.