Zohocorp ManageEngine Exchange Reporter Plus versions prior to build 5802 contain a stored cross‑site scripting flaw in the Distribution Lists report. The vulnerability enables an attacker to inject malicious scripts into report data that is later rendered by the web interface, which could lead to session hijacking, defacement, or arbitrary code execution in the victim’s browser.

All installations of ManageEngine Exchange Reporter Plus that use a build number older than 5802 are affected. Product versions listed in the Common Platform Enumeration entries, such as 5.8 and earlier releases, carry the flaw. Administrators should verify the currently installed build against the 5802 threshold and apply the vendor’s fix or upgrade accordingly.

The CVSS score of 7.3 reflects a high severity level, while the EPSS score of less than 1% indicates a low probability of active exploitation at this time. The flaw is not included in the CISA Known Exploited Vulnerabilities catalog. Based on the description, the likely attack vector is through crafted input that populates the Distribution Lists report; an attacker who can submit or modify report data could cause trusted users’ browsers to execute injected scripts.