CVE-2025-40978 — Multiple vulnerabilities in WorkDo products
Stored Cross-Site Scripting (XSS) vulnerability in WorkDo's eCommerceGo SaaS, consisting of a stored XSS due to a lack of proper validation of user input by sending a POST reque…
Published: 2026-01-12 · CVSS: 5.1 · CVSS 4.0
Stored Cross-Site Scripting (XSS) vulnerability in WorkDo's eCommerceGo SaaS, consisting of a stored XSS due to a lack of proper validation of user input by sending a POST request to ‘/ticket/x/conversion’, using the ‘reply_description’ parameter.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7