Improper neutralization of input in Microsoft SharePoint results in cross‑site scripting vulnerabilities that enable an authorized attacker to inject malicious HTML or JavaScript into web pages. When such content is viewed by users, the attacker can impersonate legitimate pages or content, potentially luring users to perform unintended actions such as submitting credentials or clicking malicious links.

Microsoft SharePoint Server versions 2016, 2019, and the Subscription Edition are affected. No precise patch level information is available, so any installation of these products may be vulnerable unless patched by Microsoft.

The CVSS score of 4.6 indicates a moderate risk profile. Exploitability data is not currently available from EPSS and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Attackers would need authorized access to the SharePoint environment to inject the malicious payload, so the attack vector is likely through legitimate administrative or content‑creation channels rather than a purely remote, unauthenticated method.