Zohocorp ManageEngine Exchange Reporter Plus stores malicious JavaScript in the Permissions based on Distribution Groups report, allowing an attacker to inject code that is rendered in the victim’s browser. This stored XSS can enable credential theft, session hijacking, or defacement of the web interface, impacting the confidentiality and integrity of user data. The vulnerability is a classic client‑side cross‑site scripting flaw (CWE‑79).

Versions of ManageEngine Exchange Reporter Plus earlier than 5802, including the 5.8 series up to 5.8.5801, are affected.

The CVSS score of 7.3 indicates high severity, but the EPSS score of less than 1% suggests that exploitation is currently unlikely. The vulnerability is not listed in CISA’s KEV catalog. The attack vector is inferred to be a web‑based input form used for creating or editing the Distribution Groups report; a user with sufficient privileges can submit a malicious payload that is then persistently stored and later executed when the report is viewed. If the application allows unauthenticated or low‑privilege users to create such reports, risk increases, otherwise the impact is limited to users with direct access to the report. The potential for both user‑targeted and broader compromise remains, warranting corrective action.