Description
A stored cross-site scripting (XSS) vulnerability exists in the chart feature of SharePoint Manager Plus (SPMP) due to improper sanitization and HTML encoding of user-controlled data. An attacker can inject malicious HTML or JavaScript into attributes used to generate charts, including users' full names, site names, or group names. The injected content is stored and subsequently executed in the context of other users' browsers when the affected charts are rendered. This vulnerability was fixed in client application build 4508.
Published: 2026-10-30
Score: 8.5 High
EPSS: n/a
KEV: No
Impact: Stored Cross‑Site Scripting enabling arbitrary script execution in browsers
Action: Patch 4508
AI Analysis

Impact

A stored cross‑site scripting flaw exists in the chart feature of ManageEngine SharePoint Manager Plus. The vulnerability arises from improper sanitization and HTML encoding of user‑controlled data such as full names, site names, and group names used in chart attributes. The attacker can inject malicious HTML or JavaScript that is stored and later executed in other users’ browsers when the chart is rendered, enabling arbitrary script execution.

Affected Systems

ManageEngine SharePoint Manager Plus, all client builds older than 4508. The vulnerability was fixed in build 4508; no additional version details are provided.

Risk and Exploitability

The CVSS score is 8.5, indicating a high‑severity flaw. EPSS data is unavailable and the vulnerability is not listed in the CISA KEV catalog. The vulnerability is a stored XSS that is triggered when a chart is rendered; an attacker must be able to submit data that is stored in the chart attributes, after which the malicious code executes in viewers’ browsers. The vulnerability persists until the chart data is cleared or the application is updated to build 4508.

Generated by OpenCVE AI on October 30, 2026 at 16:17 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade SharePoint Manager Plus to client application build 4508 to apply the fix for proper input sanitization.
  • Restrict the ability to modify chart data and chart attributes to trusted administrators, limiting the opportunity for injection.
  • Configure the web application firewall or input validation mechanisms to block or escape suspicious HTML or JavaScript before it is stored in the chart attributes, as an additional control.

Generated by OpenCVE AI on October 30, 2026 at 16:17 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 30 Oct 2026 14:30:00 +0000

Type Values Removed Values Added
Description A stored cross-site scripting (XSS) vulnerability exists in the chart feature of SharePoint Manager Plus (SPMP) due to improper sanitization and HTML encoding of user-controlled data. An attacker can inject malicious HTML or JavaScript into attributes used to generate charts, including users' full names, site names, or group names. The injected content is stored and subsequently executed in the context of other users' browsers when the affected charts are rendered. This vulnerability was fixed in client application build 4508.
Title Stored Cross-Site Scripting (XSS) in SharePoint Manager Plus Chart Feature
Weaknesses CWE-79
References
Metrics cvssV4_0

{'score': 8.5, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:L/VA:N/SC:H/SI:H/SA:H'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: CIRCL

Published:

Updated: 2026-10-30T14:14:24.193Z

Reserved: 2026-10-30T14:14:17.240Z

Link: CVE-2026-119680

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-30T15:16:51.187

Modified: 2026-10-30T15:16:51.187

Link: CVE-2026-119680

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-30T16:30:16Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')