ManageEngine Exchange Reporter Plus versions prior to build 5802 contain a stored cross‑site scripting flaw in the Equipment Mailbox Details report. User‑supplied data that is injected into the report is not sanitized, so malicious JavaScript is preserved and runs whenever the report is viewed through the web interface. This flaw, identified as CWE‑79, can lead to session hijacking, credential theft or phishing actions performed in the victim’s browser.

The vulnerability applies to all installations of ManageEngine Exchange Reporter Plus that run builds earlier than 5802, as provided by Zohocorp. Any environment where administrators or users can generate or view Equipment Mailbox Details reports is susceptible.

A CVSS score of 7.3 indicates moderate‑to‑high severity. The flaw is exposed through the web application; the attacker must be able to inject the malicious content into a report, typically through authenticated access or by manipulating report generation parameters. The exploit requires the victim to open the stored report in a browser that renders JavaScript, which is a common scenario for authenticated users. EPSS data is unavailable and the vulnerability is not listed in CISA’s KEV catalog, but the persistence of the injected code and lack of privilege escalation make this a noteworthy risk for organizations relying on this reporting tool.