The vulnerability is a stored cross‑site scripting flaw in the Folder Message Count and Size report of ManageEngine Exchange Reporter Plus. Malicious code injected into the report data can be executed in a victim’s browser whenever the report is viewed, allowing an attacker to run scripts in the context of that user.

Zohocorp ManageEngine Exchange Reporter Plus, versions prior to 5802—including 5.8.5800 and 5.8.5801—are affected.

With a CVSS score of 7.3 the flaw is considered high severity. The EPSS score is below 1% and the vulnerability is not listed in the CISA KEV catalog, indicating a low likelihood of widespread exploitation. The likely attack path involves the web interface that allows users to supply input that is stored and later rendered in the report; based on the description, it is inferred that an attacker would need some level of access to supply the malicious content, but authentication requirements are not specified.