Zohocorp ManageEngine Exchange Reporter Plus versions through 5721 contain a stored cross-site scripting (XSS) vulnerability in the Instant Search feature. This vulnerability allows an attacker with limited privileges to inject malicious scripts that can be stored and executed in the context of other users. The CVSS score is 6.3, indicating a medium severity impact primarily affecting confidentiality and integrity.