CVE-2026-28756 | Stored XSS vulnerability in Exchange Reporter Plus

Details

CVE-2026-28756 describes a stored XSS vulnerability in the Permissions based on Distribution Groups report within the Reports module.

Impact

This vulnerability could allow an authenticated attacker with Exchange administrative privileges within the Exchange organization to inject and execute malicious scripts. Successful exploitation may enable the attacker to perform actions within Exchange Reporter Plus based on the privileges of the victim who accesses the affected report.

Fix

This issue has been resolved in Exchange Reporter Plus version 5802 by implementing proper input validation.

Steps to update

Update your Exchange Reporter Plus instance to build 5802 or later using the service pack.

Acknowledgement

This vulnerability was reported by C311 through the Zoho BugBounty program.

If you have any questions or need assistance updating the product to the latest version, please contact product support or our security team.