SharePoint Manager Plus CVE-2026-119680

Exploitation requires an authenticated low-privilege account in SharePoint Manager Plus (PR:L) that can set or influence user-controlled attributes consumed by the chart feature - specifically a user's full name, a site name, or a group name. The stored payload only fires when another user renders the affected chart, so successful attack also depends on passive victim interaction (UI:P) by a user viewing those charts, ideally a higher-privileged administrator to maximize impact. Limiting factors: the attacker cannot act fully unauthenticated, cannot force immediate execution without a victim loading the chart, and the condition is tied to the chart-rendering code path for those specific attributes; environments where untrusted users cannot populate these name fields are correspondingly harder to exploit. The complete fix is upgrading to client application build 4508 as stated by the vendor; no alternative mitigation is provided in the available sources.

This is a genuine but conditional risk rather than a drop-everything emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P) describes a network-reachable, low-complexity stored XSS that requires the attacker to hold a low-privilege authenticated account (PR:L) and requires passive victim interaction (UI:P) - a legitimate user viewing the affected chart. The high impact scores (VC:H, and subsequent-system SC:H/SI:H/SA:H) reflect that injected script runs in the browser context of other users, including likely higher-privileged SharePoint administrators, which is why the composite score reaches 8.5. However, no EPSS probability, no CISA KEV listing, and no PoC are present in the supplied data, so there is no evidence of active or at-scale exploitation. The vuln.today decision label is 'this_week' (not act_now/emergency), consistent with a serious-but-not-under-active-attack posture. Net: treat this as a prompt-patch item for environments running SharePoint Manager Plus, weighted by whether low-privilege user accounts can populate the full name, site name, or group name fields that feed the chart feature. EPSS/KEV signals are absent, not low - their absence should not be read as proof the issue is low-risk.

A low-privilege authenticated SharePoint Manager Plus user sets their full name (or a site/group name they control) to a value containing a malicious HTML/JavaScript payload. The payload is stored and later rendered unsanitized when another user - plausibly an administrator - opens a chart that displays those attributes, executing the script in that victim's session. No public exploit code is identified in the available data, but stored XSS of this kind is straightforward to craft once the injectable field is known.