CVE-2025-67824: WorklogPRO Jira Timesheets XSS Flaw

CVE-2025-67824 Overview

CVE-2025-67824 is a Stored Cross-Site Scripting (XSS) vulnerability in the WorklogPRO - Jira Timesheets plugin for Jira Data Center. The vulnerability allows attackers to inject arbitrary HTML or JavaScript code via a crafted payload placed in the name of a filter. When a user attempts to create a timesheet with the filter timesheet type on the custom timesheet dialog, the malicious code executes in the victim's browser because the filter name is not properly sanitized during the action.

Critical Impact

Attackers can execute arbitrary JavaScript in authenticated user sessions, potentially leading to session hijacking, credential theft, or privilege escalation within Jira Data Center environments.

Affected Products

• WorklogPRO - Jira Timesheets plugin for Jira Data Center versions before 4.24.2-jira9
• WorklogPRO - Jira Timesheets plugin for Jira Data Center versions before 4.24.2-jira10
• WorklogPRO - Jira Timesheets plugin for Jira Data Center versions before 4.24.2-jira11

Discovery Timeline

• January 20, 2026 - CVE-2025-67824 published to NVD
• January 21, 2026 - Last updated in NVD database

Technical Details for CVE-2025-67824

Vulnerability Analysis

This vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), commonly known as Cross-Site Scripting. The flaw exists in the WorklogPRO plugin's handling of filter names within the custom timesheet creation dialog. When users create or interact with timesheets that reference filters, the plugin fails to properly sanitize or encode the filter name before rendering it in the browser context.

The stored nature of this XSS vulnerability makes it particularly dangerous because the malicious payload persists in the application database. Any user who subsequently views the affected timesheet dialog will trigger the execution of the injected script without any additional attacker interaction.

Root Cause

The root cause of this vulnerability is insufficient input validation and output encoding in the WorklogPRO plugin. Specifically, when processing filter names for display in the custom timesheet dialog, the application does not sanitize user-controlled input before rendering it in the HTML context. This allows specially crafted filter names containing JavaScript or HTML to be stored and later executed when the page is rendered.

Attack Vector

The attack requires network access and targets users who interact with the timesheet creation functionality. An attacker with the ability to create or modify filters in Jira can inject malicious JavaScript into the filter name field. This payload is stored in the application and executed whenever another user attempts to create a timesheet using the filter timesheet type. The attack is particularly effective against administrators and team leads who frequently manage timesheets, potentially allowing attackers to escalate privileges or access sensitive project data.

The exploitation flow involves:

1. An attacker creates or modifies a Jira filter with a malicious name containing JavaScript code
2. The payload is stored in the Jira database without proper sanitization
3. When a victim navigates to the custom timesheet dialog and selects the filter timesheet type, the filter name is rendered without encoding
4. The injected JavaScript executes in the victim's browser with their session context

Detection Methods for CVE-2025-67824

Indicators of Compromise

• Unusual filter names containing HTML tags such as <script>, <img>, <svg>, or event handlers like onerror, onload, onclick
• Unexpected JavaScript execution warnings or console errors when accessing timesheet dialogs
• Reports from users experiencing unexpected browser behavior or redirects when creating timesheets
• Suspicious filter modification activity in Jira audit logs

Detection Strategies

• Monitor Jira audit logs for filter creation or modification events containing suspicious patterns or encoded characters
• Implement Web Application Firewall (WAF) rules to detect XSS payloads in HTTP requests targeting the WorklogPRO plugin endpoints
• Deploy browser-based Content Security Policy (CSP) headers to limit script execution sources and detect policy violations
• Use SentinelOne's Singularity XDR to monitor for anomalous browser activity and JavaScript execution patterns associated with XSS attacks

Monitoring Recommendations

• Enable verbose logging for the WorklogPRO plugin and monitor for errors related to filter rendering
• Configure alerting on Jira audit events related to filter modifications, especially bulk or rapid changes
• Implement real-time monitoring of user sessions for signs of session hijacking or unauthorized data access following timesheet interactions
• Review Jira access logs for unusual patterns of timesheet dialog access across multiple user accounts

How to Mitigate CVE-2025-67824

Immediate Actions Required

• Upgrade WorklogPRO plugin to version 4.24.2-jira9, 4.24.2-jira10, or 4.24.2-jira11 depending on your Jira Data Center version
• Audit existing filters for suspicious names containing potential XSS payloads and sanitize or remove malicious entries
• Restrict filter creation and modification permissions to trusted users until the patch is applied
• Implement Content Security Policy headers to mitigate the impact of any successful XSS exploitation

Patch Information

The vendor has released patched versions of the WorklogPRO plugin that address this vulnerability. Organizations should update to the following versions based on their Jira Data Center deployment:

• For Jira 9.x: Update to WorklogPRO version 4.24.2-jira9 or later
• For Jira 10.x: Update to WorklogPRO version 4.24.2-jira10 or later
• For Jira 11.x: Update to WorklogPRO version 4.24.2-jira11 or later

Version history and download links are available at the Atlassian Marketplace Version History. Additional security advisory details can be found in the Starware Security Advisory.

Workarounds

• Temporarily disable the WorklogPRO plugin if immediate patching is not possible
• Implement strict Content Security Policy headers to prevent inline script execution: script-src 'self'
• Restrict filter management permissions to administrators only to limit potential attack vectors
• Deploy a Web Application Firewall with XSS detection rules in front of Jira Data Center instances

# Example Content Security Policy header configuration for Apache
# Add to Jira's httpd.conf or .htaccess file
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; frame-ancestors 'self';"