Improper neutralization of user input in Microsoft SharePoint’s web page rendering can lead to cross‑site scripting, allowing an authorized user to inject malicious content that appears legitimate to other users. This vulnerability can be exploited to spoof website elements and trick individuals into interacting with deceptive interfaces, potentially leading to credential theft or social engineering attacks.

The affected products are Microsoft SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition. No specific version ranges are currently listed in the advisory, so the vulnerability likely applies to all releases of these products until a patch is released.

The CVSS base score of 5.4 indicates a moderate impact, and the absence of an EPSS rating means there is no publicly available data on exploit probability. The vulnerability is not listed in CISA’s KEV catalog, suggesting no confirmed exploitation yet. Because the flaw requires authorization, the attack surface is limited to users with editing or administrative privileges; compromised credentials or insider threat could therefore be used to perform spoofing.