A stored cross‑site scripting vulnerability exists in the Mails Exchanged Between Users report of ManageEngine Exchange Reporter Plus. The flaw allows an attacker to inject malicious script code that is persisted in the report data, and executed when a user views the report. This can lead to theft of session cookies, user credentials, or the execution of arbitrary actions on behalf of the victim.

Zohocorp ManageEngine Exchange Reporter Plus versions prior to 5802, including the 5.8 series and sub‑builds 5800 and 5801, are vulnerable. Any deployment using these versions could be exposed to the vulnerability.

The vulnerability has a CVSS score of 7.3, indicating high severity. The EPSS score is below 1%, suggesting a low current exploit probability, and it is not listed in the CISA KEV catalog. The attack is likely to occur when a malicious user crafts or injects content into the report, which is then displayed to legitimate users who open the Mails Exchanged Between Users report. The impact could enable session hijacking or other lateral actions, however the exploit would require the victim to view the compromised report. Therefore, while the risk is moderate, the potential damage is significant if users are unaware of the threat.