CVE-2026-119680 in SharePoint Manager Plus
Summary
by MITRE • 10/30/2026
A stored cross-site scripting (XSS) vulnerability exists in the chart feature of SharePoint Manager Plus (SPMP) due to improper sanitization and HTML encoding of user-controlled data. An attacker can inject malicious HTML or JavaScript into attributes used to generate charts, including users' full names, site names, or group names. The injected content is stored and subsequently executed in the context of other users' browsers when the affected charts are rendered. This vulnerability was fixed in client application build 4508.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/30/2026
The identified security flaw represents a classic instance of Stored Cross-Site Scripting, formally categorized under CWE-79 within the Common Weakness Enumeration framework. This vulnerability resides specifically within the chart generation module of ManageEngine SharePoint Manager Plus, where the application fails to adequately sanitize or HTML encode user-supplied input before storing it in the backend database and subsequently rendering it in web-based visualizations. The root cause lies in the improper handling of special characters that have semantic meaning in HTML and JavaScript contexts, allowing malicious scripts to be embedded directly into data fields such as full names, site identifiers, or group designations without triggering validation errors or automatic escaping mechanisms.
The operational impact of this vulnerability is significant due to its persistent nature. Unlike reflected XSS attacks which require an attacker to lure a user to a specific URL, stored vulnerabilities persist on the server side and are served to every user who accesses the affected functionality. When an administrator or authorized user views a dashboard containing charts populated with compromised data, the malicious script executes automatically within their browser session in the context of the SharePoint Manager Plus application. This execution environment grants the injected code access to sensitive cookies, session tokens, local storage contents, and potentially the ability to perform actions on behalf of the victim if they have elevated privileges within the management console.
From a threat actor perspective, this vulnerability aligns with several techniques in the MITRE ATT&CK framework for enterprise environments. It primarily maps to T1059.007, which covers JavaScript execution via browser-based attacks, and potentially T1189, Drive-by Compromise if the script is designed to redirect users or download additional payloads. The persistence of the payload means that a single successful injection can lead to widespread compromise across multiple user sessions without further interaction from the attacker, facilitating credential theft, session hijacking, or lateral movement within the managed SharePoint infrastructure.
The vulnerability has been addressed in client application build 4508 through enhanced input validation and output encoding strategies. To mitigate risks for organizations still operating on older versions, immediate patching is required to apply this fix. In addition to updating software, administrators should implement strict Content Security Policy headers to restrict the execution of inline scripts where possible, ensuring that even if similar vulnerabilities exist in other modules, their impact is contained. Regular security audits focusing on data sanitization practices for all user-facing input fields are recommended to prevent recurrence and maintain the integrity of management tools used for monitoring SharePoint environments.