A vulnerability in Zohocorp ManageEngine Exchange Reporter Plus allows an attacker to store malicious JavaScript code in the Equipment Mailbox Details report. When a user opens the report, the script runs in the browser, providing the attacker with client‑side code execution. This flaw is identified as CWE‑79 and does not include additional exploitation capabilities beyond what the injected script can perform.

The issue affects Zohocorp ManageEngine Exchange Reporter Plus from all releases prior to build 5802, including the 5.8 version series and the 5800 and 5801 builds.

The CVSS score of 7.3 signals high severity, while the EPSS score below 1% indicates a low likelihood of exploitation in the wild. It is not listed in the CISA Known Exploited Vulnerabilities catalog. Based on the description, it is inferred that an attacker likely requires authenticated access to create or edit the Equipment Mailbox Details report; once a payload is stored, it is presented to any user who views the report, providing a persistent cross‑site scripting vector.