Improper neutralization of user supplied input during web page generation in Microsoft SharePoint Server Subscription Edition allows a cross‑site scripting flaw. The vulnerability enables an authenticated attacker to inject malicious code that can spoof legitimate requests or messages over the network, potentially tricking users or services into believing the attacker is a trusted source.

Microsoft SharePoint Server Subscription Edition is affected. No specific version numbers are listed in the current advisory, so all installed instances of this product should be considered vulnerable.

The formal CVSS score is 7.3, categorising the defect as high severity. The EPSS score is not available and the flaw is not listed in the CISA KEV catalogue. Because the flaw is a cross‑site scripting issue, the likely attack vector is a web request that an authorised user submits, such as publishing or editing a page. Exploitation would require the attacker to have valid credentials that give them permission to create or modify web pages, after which they can inject malicious content that will be rendered for other users and used to spoof legitimate activity.