Postorius up to version 1.3.13 fails to escape HTML characters in message subjects when rendering them in the Held messages pop‑up. This stored XSS flaw allows an attacker to inject malicious JavaScript that runs in the browser context of any user who opens the pop‑up, enabling session hijacking, credential theft, or defacement of the web interface.

All installations of the Postorius project:Postorius web interface from the launch of the project through 1.3.13 are vulnerable. The fix is included in the GitLab commit referenced in the advisory; upgrading to any release after this commit will remediate the flaw.

The CVSS score of 7.2 indicates significant impact. EPSS is not available and the vulnerability is not listed in the CISA KEV catalog, but it was exploited in the wild in May 2026. The likely attack vector requires a victim to click on a held message, triggering the pop‑up rendering of the unescaped subject. Once the pop‑up is loaded, the injected script executes with the privileges of the user’s browser session.