Description
Dayforce ESS Excelity is vulnerable to Reflected XSS in multiple endpoints. An attacker can prepare a specially crafted URL that, when opened, results in arbitrary JavaScript execution in the victim's browser.
This issue was fixed in version V4.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Dayforce | ESS Excelity | < V4 | V4 |
References
- https://cert.pl/en/posts/2026/09/CVE-2026-73640 third-party-advisory
- https://hcm.excelityglobal.com/ESS product