8.5
HighCVSS 4.0 · from CIRCL
CVE-2026-119680
Stored Cross-Site Scripting (XSS) in SharePoint Manager Plus Chart Feature
SharePoint Manager Plus · Cross-site scripting · CWE-79AffectedSharePoint Manager Plus
FixUpdate to 450 or newer
PublishedOct 30, 14:14 · CIRCL
ScoredOct 30 · 8.5 · CIRCL
Exploit code publicNone known · checked 01:19 UTC
ExploitedNone known · CISA KEV checked 01:56 UTC
What we know
No known exploitation. CISA KEV, checked 01:56 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 01:19 UTC.
An attacker needs network access and an account. CVSS: network, low privileges.
Someone has to open, click or run something first. CVSS: user interaction required.
A successful attack can read data. CVSS impact.
Description
A stored cross-site scripting (XSS) vulnerability exists in the chart feature of SharePoint Manager Plus (SPMP) due to improper sanitization and HTML encoding of user-controlled data. An attacker can inject malicious HTML or JavaScript into attributes used to generate charts, including users' full names, site names, or group names. The injected content is stored and subsequently executed in the context of other users' browsers when the affected charts are rendered. This vulnerability was fixed in client application build 4508.
From CIRCL
Affected and fixed versions
ProductAffectedFixed inSharePoint Manager PlusNot affected450
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known