> For the complete documentation index, see [llms.txt](https://docs.offsecguy.com/cve/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.offsecguy.com/cve/hr-performance-solutions/performance-pro-v3.19.17-or-reflected-cross-site-scripting-xss-disclosures.md).

# Performance Pro v3.19.17 | Reflected Cross-Site Scripting (XSS) Disclosures

## Summary of Findings

* [Reflected XSS in Employee Notes](/cve/hr-performance-solutions/vulnerability/reflected-xss-employee-notes.md)
  * CVE-2025-60934
* [Reflected XSS in Future Goals](/cve/hr-performance-solutions/vulnerability/reflected-xss-future-goals.md)
  * CVE-2025-60933
* [Reflected XSS in Current Goals](/cve/hr-performance-solutions/vulnerability/reflected-xss-current-goals.md)
  * CVE-2025-60932

### Timeline

* Reported to Vendor: March, 2025
* Patched: TBD
* Published: TBD