---
id: "CVE-2026-119680"
kind: "vulnerability"
aliases: ["CVE-2026-119680"]
title: "SharePoint Manager Plus: stored XSS in charts runs scripts in other users' browsers"
severity: "high"
cvss: 8.5
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["other", "self-hosted", "sharepoint-manager-plus", "windows"]
not_affected_if: ["build-4508-or-later"]
published_at: "2026-10-30T15:16:51+00:00"
first_seen_at: "2026-10-30T15:31:11+00:00"
updated_at: "2026-10-30T15:33:19+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119680", "first_seen_at": "2026-10-30T15:31:11+00:00"}]
---

# SharePoint Manager Plus: stored XSS in charts runs scripts in other users' browsers

SharePoint Manager Plus does not sanitize user-controlled fields such as full names, site names and group names that feed its chart feature. An attacker who can set those fields can store JavaScript that runs in the browser of any other user who opens the affected chart.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed SharePoint Manager Plus client build number against the fixed build 4508 (`4508`)
- Review whether users can edit their full name, site name or group name fields in the product

## Fix

- SharePoint Manager Plus client application build `4508` or later

## Timeline

- 2026-10-30T15:31:11+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119680

## From the sources

A stored cross-site scripting (XSS) vulnerability exists in the chart feature of SharePoint Manager Plus (SPMP) due to improper sanitization and HTML encoding of user-controlled data. An attacker can inject malicious HTML or JavaScript into attributes used to generate charts, including users' full names, site names, or group names. The injected content is stored and subsequently executed in the context of other users' browsers when the affected charts are rendered. This vulnerability was fixed in client application build 4508.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_