Live › vulnerability › CVE-2026-119680
SharePoint Manager Plus does not sanitize user-controlled fields such as full names, site names and group names that feed its chart feature. An attacker who can set those fields can store JavaScript that runs in the browser of any other user who opens the affected chart.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 15:31 UTC. All times on this page are UTC.
Organizations running SharePoint Manager Plus with the chart feature in use are exposed, since the stored payload executes when charts render for other users. Users who can only read data and cannot write names, sites or groups have less exposure to injection, but the sources do not detail which roles can write those fields.
No product ranges from the sources yet.
4508)4508 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
A stored cross-site scripting (XSS) vulnerability exists in the chart feature of SharePoint Manager Plus (SPMP) due to improper sanitization and HTML encoding of user-controlled data. An attacker can inject malicious HTML or JavaScript into attributes used to generate charts, including users' full names, site names, or group names. The injected content is stored and subsequently executed in the context of other users' browsers when the affected charts are rendered. This vulnerability was fixed in client application build 4508.
This page as .md · .json · in your agent: get_signal("CVE-2026-119680")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.