Exchange Reporter Plus CVE-2025-5343

Exploitation requires an authenticated session on the Exchange Reporter Plus web console (PR:L) with the ability to submit input to the Instant Search option, which stores the attacker's script. Execution additionally requires a victim user to view the poisoned search result (UI:R), and the scope-changed impact (S:C) means the payload runs in the victim's browser context rather than the attacker's. Limiting factors: the attacker must already have valid console credentials, a separate higher-value victim must interact with the stored content, and only versions through 5721 are affected. This is not remote-unauthenticated; absence of credentials or absence of victim interaction prevents exploitation.

This is a medium-severity stored XSS (CVSS 5.4, CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) that signals a low operational priority. The CVSS vector requires authenticated access (PR:L) and victim interaction (UI:R), which caps impact at a limited (C:L/I:L) scope-changed compromise of another user's browser session rather than server takeover. EPSS reinforces low urgency at 0.45% (37th percentile), there is no CISA KEV listing (not confirmed actively exploited), and no public exploit code was identified at time of analysis. No SSVC decision data was provided in the input. The signals are internally consistent: a low-probability, authentication-gated, interaction-dependent XSS in a specialized reporting tool. This is a 'patch in normal cycle' issue, not an emergency - the main real-world risk is an internal low-privileged user (or an attacker who has already obtained reporting-console credentials) escalating against an administrator who opens a poisoned search result. No key signals conflict; the chief unknown is whether the Instant Search field is reachable by low-privilege or read-only reporting roles, which determines how easily the payload can be planted.

An authenticated low-privileged user of Exchange Reporter Plus injects a malicious JavaScript payload into the Instant Search option, which is stored by the application. When an administrator or another user later performs or views that search, the script executes in their browser session (scope change), enabling session hijacking or actions in their context. No public exploit code was identified at time of analysis, so a tailored payload would be required.