The vulnerability is a stored cross‑site scripting flaw in the Public Folder Client Permissions report of Zohocorp ManageEngine Exchange Reporter Plus. The flaw allows an attacker to embed malicious scripts that run in the browsers of users who view the report, potentially enabling session hijacking, data theft, or defacement. The weakness is classified as CWE‑79.

Zohocorp ManageEngine Exchange Reporter Plus, all releases prior to 5802, including the 5.8.x series up to 5801. These versions contain the vulnerable Public Folder Client Permissions report functionality.

The issue carries a CVSS score of 7.3, indicating high severity, while the EPSS score is below 1%, suggesting a low likelihood of exploitation. It is not listed in the CISA KEV catalog. The likely attack vector involves an authenticated or partially authenticated user inserting malicious payloads into the report that are subsequently rendered to other users who access the report. Given its impact on confidentiality and integrity within affected systems, the risk is considered high for environments that allow report generation by users with sufficient privileges.