SZB-36fcc7f8f3
EUVD-2026-114059 reports stored XSS in SharePoint Manager Plus chart feature
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- SharePoint Manager Plus
- Product
- SharePoint Manager Plus
- First seen
Summary
The EU Vulnerability Database (EUVD) entry EUVD-2026-114059 describes a stored cross-site scripting flaw in the chart feature of SharePoint Manager Plus (SPMP), scored 8.5/10 (CVSS v3.1). Per the listing, an attacker can inject malicious HTML or JavaScript into chart attributes.
If you use SharePoint Manager Plus
Apply the vendor's fix for SharePoint Manager Plus as soon as it is available
Restrict who can create or edit charts until patched
Review existing chart content for injected scripts
What the sources say 1
· Mastodon: “A stored cross-site scripting (XSS) vulnerability exists in the chart feature of SharePoint Manager Plus (SPMP) due to improper sanitization and HTML encoding of user-controlled data.” Source