Zohocorp ManageEngine Exchange Reporter Plus contains a stored cross‑site scripting flaw in the Non‑Owner Mailbox Permission report. If an attacker manages to insert malicious script into the report, the script will execute when a user opens the report, potentially enabling the attacker to execute arbitrary JavaScript in the victim’s browser. Based on the nature of stored XSS, this could lead to session cookie theft, phishing, or other client‑side attacks, though the CVE description does not explicitly list these outcomes.

All installations of ManageEngine Exchange Reporter Plus released before version 5802, including releases 5.8, 5800 and 5801, are affected.

The CVSS score of 7.3 indicates high severity. The EPSS score of less than 1% suggests that exploitation is currently unlikely. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector requires an attacker to inject malicious content into the report and for a user with permission to view the report to subsequently access it, so the risk is confined to authenticated users with view rights to the Non‑Owner Mailbox Permission report – this is inferred from the stored nature of the vulnerability.