{"id":"CVE-2026-119680","kind":"vulnerability","aliases":["CVE-2026-119680"],"related":[],"title":"SharePoint Manager Plus: stored XSS in charts runs scripts in other users' browsers","description":"A stored cross-site scripting (XSS) vulnerability exists in the chart feature of SharePoint Manager Plus (SPMP) due to improper sanitization and HTML encoding of user-controlled data. An attacker can inject malicious HTML or JavaScript into attributes used to generate charts, including users' full names, site names, or group names. The injected content is stored and subsequently executed in the context of other users' browsers when the affected charts are rendered. This vulnerability was fixed in client application build 4508.","summary":"SharePoint Manager Plus does not sanitize user-controlled fields such as full names, site names and group names that feed its chart feature. An attacker who can set those fields can store JavaScript that runs in the browser of any other user who opens the affected chart.","severity":"high","cvss":8.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["other","self-hosted","sharepoint-manager-plus","windows"],"not_affected_if":["build-4508-or-later"],"how_to_check":"- Check the installed SharePoint Manager Plus client build number against the fixed build 4508 (`4508`)\n- Review whether users can edit their full name, site name or group name fields in the product","fix":"- SharePoint Manager Plus client application build `4508` or later","status":"open","published_at":"2026-10-30T15:16:51+00:00","first_seen_at":"2026-10-30T15:31:11+00:00","triaged_at":"2026-10-30T15:33:19+00:00","updated_at":"2026-10-30T15:33:19+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-30T15:33:19Z","model":"claude-haiku-5-5","output":{"fix":"- SharePoint Manager Plus client application build `4508` or later","reach":"network","title":"SharePoint Manager Plus: stored XSS in charts runs scripts in other users' browsers","impact":"medium","summary":"SharePoint Manager Plus does not sanitize user-controlled fields such as full names, site names and group names that feed its chart feature. An attacker who can set those fields can store JavaScript that runs in the browser of any other user who opens the affected chart.","audience":"businesses","category":"other","nicknames":[],"who_cares":["sharepoint-manager-plus","windows","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"script runs in other users' browsers, session data exposed","analyst_note":"Confirm from the vendor advisory which account role can write the injected fields and whether the chart feature is on by default.","how_to_check":"- Check the installed SharePoint Manager Plus client build number against the fixed build 4508 (`4508`)\n- Review whether users can edit their full name, site name or group name fields in the product","plain_action":"","needs_analyst":true,"not_affected_if":["build-4508-or-later"],"who_is_affected":"Organizations running SharePoint Manager Plus with the chart feature in use are exposed, since the stored payload executes when charts render for other users. Users who can only read data and cannot write names, sites or groups have less exposure to injection, but the sources do not detail which roles can write those fields.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000693,"input_tokens":4200,"output_tokens":546,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-119680':16A,19A '-2026':15A,18A '4508':159C 'affect':75B,147C 'applic':157C 'attack':54B,108C 'attribut':116C 'browser':13A,67B,144C 'build':158C 'chart':7A,51B,76B,88C,120C,148C 'client':156C 'content':132C 'context':140C 'control':37B,105C 'cross':80C 'cross-sit':79C 'cve':14A,17A 'data':106C 'due':95C 'encod':101C 'execut':137C 'exist':85C 'featur':52B,89C 'feed':49B 'field':38B,59B 'fix':154C 'full':41B,123C 'generat':119C 'group':46B,128C 'host':23B 'html':100C,112C 'improp':97C 'includ':121C 'inject':110C,131C 'javascript':62B,114C 'malici':111C 'manag':2A,26B,30B,92C 'name':42B,44B,47B,124C,126C,129C 'open':73B 'plus':3A,27B,31B,93C 'render':150C 'run':8A,64B 'sanit':34B,98C 'script':9A,82C 'self':22B 'self-host':21B 'set':57B 'sharepoint':1A,25B,29B,91C 'sharepoint-manager-plus':24B 'site':43B,81C,125C 'spmp':94C 'store':4A,61B,78C,134C 'subsequ':136C 'use':117C 'user':12A,36B,71B,104C,122C,143C 'user-control':35B,103C 'vulner':84C,152C 'window':28B 'xss':5A,83C","nicknames":[],"mitigations":[],"who_affected":"Organizations running SharePoint Manager Plus with the chart feature in use are exposed, since the stored payload executes when charts render for other users. Users who can only read data and cannot write names, sites or groups have less exposure to injection, but the sources do not detail which roles can write those fields.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T15:16:51+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:L/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"5a6e4751-2f3f-4070-9419-94fb35b644e8","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119680","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119680","severity":null,"published_at":"2026-10-30T15:16:51+00:00","modified_at":"2026-10-30T15:16:51+00:00","first_seen_at":"2026-10-30T15:31:11+00:00","fetched_at":"2026-10-30T15:31:11+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}