---
id: CVE-2026-119680
title: Stored Cross-Site Scripting (XSS) in SharePoint Manager Plus Chart Feature
summary: >-
  A stored cross-site scripting (XSS) vulnerability exists in the chart feature
  of SharePoint Manager Plus (SPMP) due to improper sanitization and HTML
  encoding of user-controlled data. An attacker can inject malicious HTML or
  JavaScript i…
severity: high
cvss: 8.5
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:L/VA:N/SC:H/SI:H/SA:H'
cvssSource: cna
cwe:
  - CWE-79
vendor: ManageEngine
product: SharePoint Manager Plus
affected:
  - sharepoint_manager_plus
published: '2026-10-30'
updated: '2026-10-30'
sourceUpdated: '2026-10-30T14:14:24.193Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-119680'
references:
  - url: >-
      https://pitstop.manageengine.com/portal/en/community/topic/sharepoint-manager-plus-build-4508-is-here
tags:
  - cve.org
epss: 0.0024
epssPercentile: 0.15275
ingestedAt: '2026-11-05T16:07:30.294Z'
---

## Overview

A stored cross-site scripting (XSS) vulnerability exists in the chart feature of SharePoint Manager Plus (SPMP) due to improper sanitization and HTML encoding of user-controlled data. An attacker can inject malicious HTML or JavaScript into attributes used to generate charts, including users' full names, site names, or group names. The injected content is stored and subsequently executed in the context of other users' browsers when the affected charts are rendered. This vulnerability was fixed in client application build 4508.

## Affected

- `sharepoint_manager_plus`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.