WorklogPRO - Timesheets for Jira Cross-Site Scripting Vulnerability

A stored cross-site scripting vulnerability has been identified in the WorklogPRO - Timesheets for Jira plugin for Jira Data Center. This issue affects versions prior to 4.23.6-jira10 and prior to 4.23.5-jira9. The vulnerability allows users and attackers to inject arbitrary HTML or JavaScript by exploiting a flaw in how the plugin handles input in the issue's summary field.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user.

Remediation

Users can update to WorklogPRO - Timesheets for Jira versions 4.25.2-jira10, 4.25.2-jira9, or 4.24.2-jira9 to address this vulnerability.