{"id":"CVE-2026-54433","title":"In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, there is Stored Cross-Site Scripting (XSS) via a crafted plain-text email message","summary":"In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, there is Stored Cross-Site Scripting (XSS) via a crafted plain-text email message. The attacker-controlled JavaScript executes within the victim's authenticated session simply by…","severity":"high","cvss":7.2,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","cwe":["CWE-79"],"vendor":"roundcube","product":"webmail","affected":["webmail < 1.6.17","webmail >= 1.7.0, < 1.7.2"],"patched":["webmail 1.7.2"],"published":"2026-07-14","updated":"2026-07-17","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-54433","references":[{"url":"https://roundcube.net/news/2026/07/05/security-updates-1.6.17-and-1.7.2","label":"cve@mitre.org"}],"tags":["nvd","exploit-available"],"epss":0.00311,"epssPercentile":0.24251,"ingestedAt":"2026-07-17T20:15:42.892Z","exploits":{"github":1,"githubRepos":["https://github.com/aramosf/CVE-2026-54433"],"checkedAt":"2026-09-24T07:53:07.087Z"},"exploitAvailable":true,"slug":"CVE-2026-54433","body":"## Overview\n\nIn Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, there is Stored Cross-Site Scripting (XSS) via a crafted plain-text email message. The attacker-controlled JavaScript executes within the victim's authenticated session simply by opening or previewing the message (zero-click).\n\n## Affected\n\n- `webmail < 1.6.17`\n- `webmail >= 1.7.0, < 1.7.2`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `webmail 1.7.2`","depth":"midnight","depthScore":52,"depthScoreParts":{"impact":39.6,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":5342,"id":"CVE-2026-54433","ts":1788887267668,"field":"exploit_available","old":"false","new":"true"},{"seq":4225,"id":"CVE-2026-54433","ts":1788886383349,"field":"exploit_available","old":"true","new":"false"},{"seq":2981,"id":"CVE-2026-54433","ts":1788883047279,"field":"exploit_available","old":"false","new":"true"},{"seq":2010,"id":"CVE-2026-54433","ts":1788882451629,"field":"exploit_available","old":"true","new":"false"},{"seq":1086,"id":"CVE-2026-54433","ts":1788881888279,"field":"exploit_available","old":"false","new":"true"}]}