Microsoft SharePoint implements cross‑site scripting by failing to neutralize data when rendering web pages. This weakness allows an authenticated attacker to embed malicious script into a page, potentially confusing or misdirecting other users through spoofed content. The vulnerability is a classic example of CWE‑79, where improper output encoding can lead to client‑side attacks.

The flaw affects Microsoft SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition. Specific version numbers are not disclosed, so all releases of these products remain vulnerable until an update is issued.

The CVSS score of 4.6 indicates a moderate severity. EPSS data is unavailable and the vulnerability is not listed in the CISA KEV catalog, suggesting limited or no known active exploitation. An attacker must be authenticated and have permissions to modify content to exploit the flaw, so the risk hinges on credential compromise or mis‑configured permissions. Exploitation would result in unauthorized content spoofing rather than remote code execution or data loss.