CVE-2026-119680

UNKNOWN 0.0

Stored Cross-Site Scripting (XSS) in SharePoint Manager Plus Chart Feature

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

A stored cross-site scripting (XSS) vulnerability exists in the chart feature of SharePoint Manager Plus (SPMP) due to improper sanitization and HTML encoding of user-controlled data. An attacker can inject malicious HTML or JavaScript into attributes used to generate charts, including users' full names, site names, or group names. The injected content is stored and subsequently executed in the context of other users' browsers when the affected charts are rendered. This vulnerability was fixed in client application build 4508.

CWE	CWE-79
Vendor	manageengine
Product	sharepoint manager plus
Published	Oct 30, 2026

Stay Ahead of the Next One

Get instant alerts for manageengine sharepoint manager plus

Be the first to know when new unknown vulnerabilities affecting manageengine sharepoint manager plus are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

ManageEngine / SharePoint Manager Plus

All versions affected

References

NVD ↗ CVE.org ↗ EPSS Data ↗

pitstop.manageengine.com: https://pitstop.manageengine.com/portal/en/community/topic/sharepoint-manager-plus-build-4508-is-here

Credits

🔍 Anas LAABAB with IMRIM (https://imrim.lu)