This vulnerability arises when the password plugin in Roundcube Webmail sends an error message from a password driver to the user interface without performing HTML escaping. The error text is concatenated directly into the page, allowing a backend component that can influence that text – for example, an API like DirectAdmin – to inject malicious script. The injected script executes within the victim’s browser session, exposing the user to cookie theft, session hijacking, or other typical XSS consequences. The weakness is identified as CWE‑79 and represents a moderate‑risk vector for compromising confidentiality on affected instances.

The issue affects all installations of Roundcube Webmail before version 1.6.20 and those using versions 1.7.x before 1.7.5. The vendor is Roundcube. Exact product names are Roundcube Webmail. No other vendors are listed as affected.

The CVSS score of 4.7 indicates a medium severity. No EPSS data is available, and the vulnerability is not catalogued in CISA’s KEV catalog. The attack would normally occur through an untrusted backend that can deliver the malformed error string. An attacker would need to gain control or influence over such a backend service to exploit the flaw. The likelihood of exploitation is therefore limited to scenarios where the backend is compromised or maliciously configured, but the potential impact for the compromised session is significant.