CVE-2026-28754

CWE-79 — Cross-site Scripting (XSS)4 documents4 sources

Severity

4.8MEDIUM

EPSS

0.0%

top 94.74%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Zohocorp Manageengine Exchange Reporter Plus

Timeline

PublishedApr 3

Description

Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to Stored XSS in Distribution Lists report.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:NExploitability: 2.1 | Impact: 5.2

Affected Packages2 packages

▶CVEListV5zohocorp/manageengine_exchange_reporter_plus< 5802

▶NVDzohocorp/manageengine_exchange_reporter_plus< 5.8+1

🔴Vulnerability Details

GHSA

GHSA-3hmr-crcq-hxcv: Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to Stored XSS in Distribution Lists report↗2026-04-03

▶

CVEList

Stored XSS Vulnerability↗2026-04-03

▶

🕵️Threat Intelligence

Wiz

CVE-2026-28754 Impact, Exploitability, and Mitigation Steps | Wiz↗

▶