CVE-2026-119680：SharePoint Manager Plus 圖表功能儲存型 XSS 漏洞已於 4508 版本修補
CVE-2026-119680 - Stored Cross-Site Scripting (XSS) in SharePoint Manager Plus Chart Feature
導語 CVE-2026-119680 影響 SharePoint Manager Plus 的圖表功能，已於 4508 版本修補。
A stored cross-site scripting (XSS) vulnerability exists in the chart feature of SharePoint Manager Plus (SPMP) due to improper sanitization and HTML encoding of user-controlled data. An attacker can inject malicious HTML or JavaScript into attributes used to generate charts, including users' full names, site names, or group names. The injected content is stored and subsequently executed in the context of other users' browsers when the affected charts are rendered. This vulnerability was fixed in client application build 4508.
Impact
Affected Products
The following products are affected by CVE-2026-119680
vulnerability.
Even if cvefeed.io is aware of the exact versions of the
products
that
are
affected, the information is not represented in the table below.
| ID | Vendor | Product | Action |
|---|---|---|---|
| 1 | Zohocorp | manageengine_sharepoint_manager_plus |
The Common Vulnerability Scoring System is a standardized framework for assessing the severity of vulnerabilities in software and systems. We collect and displays CVSS scores from various sources for each CVE.
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 4.0 | HIGH | 5a6e4751-2f3f-4070-9419-94fb35b644e8 |
Update SharePoint Manager Plus to build 4508 or later to fix the stored XSS vulnerability.
- Update SharePoint Manager Plus to build 4508 or later.
- Validate input sanitization and HTML encoding for chart data.
- Ensure user-supplied data is properly escaped.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-119680 vulnerability anywhere in the article.
EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days. Following chart shows the EPSS score history of the vulnerability.