A stored cross-site scripting (XSS) vulnerability exists in the chart feature of SharePoint Manager Plus (SPMP) due to improper sanitization and HTML encoding of user-controlled data. This allows attackers to inject malicious HTML or JavaScript into attributes used for generating charts, such as users' full names, site names, or group names. The malicious content is stored and executed in the browsers of other users viewing the affected charts. The vulnerability was fixed in client application build 4508.