CVE-2026-119680

High

Description

A stored cross-site scripting (XSS) vulnerability exists in the chart feature of SharePoint Manager Plus (SPMP) due to improper sanitization and HTML encoding of user-controlled data. An attacker can inject malicious HTML or JavaScript into attributes used to generate charts, including users' full names, site names, or group names. The injected content is stored and subsequently executed in the context of other users' browsers when the affected charts are rendered. This vulnerability was fixed in client application build 4508.

SeverityHigh

CVSS8.5

Exploit probability—

ProductSharePoint Manager Plus (SPMP)

PublishedOct 30, 2026

First seenNov 4, 2026

Weakness typeCWE-79Cross-site scripting (XSS)

How to fix

Update

SharePoint Manager Plus (SPMP)4508 or later

Vendor advisories

pitstop.manageengine.com/portal/en/community/topic/sharepoint-manager-plus-build-4508-is-here

Affected products

Product	Affected versions	Fixed in
SharePoint Manager Plus (SPMP)	No range specified	4508

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.