Improper neutralization of user input during SharePoint web page rendering enables a cross‑site scripting (XSS) vulnerability that an attacker can exploit to spoof legitimate content over the network. This flaw allows the attacker to insert malicious code into pages that will be interpreted by other users, potentially feigning authority or identity and undermining user trust.

Microsoft SharePoint Server Subscription Edition (available version details not provided).

The vulnerability carries a CVSS score of 4.6, indicating moderate severity. EPSS information is unavailable and the issue is not listed in the CISA KEV catalog. Exploitation requires an attacker to have authorized access to the SharePoint environment, after which the XSS can be leveraged to perform spoofing. The moderate CVSS coupled with the need for legitimate credentials suggests that while the risk is not critical, it remains a meaningful concern for Active SharePoint deployments.