Zohocorp ManageEngine Exchange Reporter Plus contains a stored cross‑site scripting flaw in the Non‑Owner Mailbox Permission report. An attacker can embed malicious JavaScript that is preserved and displayed to any user who views the report, resulting in arbitrary script execution within the victim’s browser. This allows theft of session cookies, injection of forged requests, or further compromise of system integrity.

The flaw affects all ManageEngine Exchange Reporter Plus installations running versions earlier than 5802. The affected vendor is Zohocorp, and the CPE identifiers correspond to the product in question.

The CVSS score of 7.3 indicates a high‑severity vulnerability. The EPSS score is not available and the issue is not listed in the CISA KEV catalog, suggesting no widely known public exploit yet. Exploitation requires an authenticated attacker who can submit data to the report, likely limited to privileged users. However, the stored payload delivery combined with possible privilege escalation makes the risk significant, warranting prompt remediation.