medium · CVSS v3 4.7

CVE-2026-114718

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a cross-site scripting vulnerability in the passwo…

Description

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a cross-site scripting vulnerability in the password plugin. Error text returned by a password driver was concatenated into the message presented to the user without HTML escaping, so a backend able to influence that text, such as the DirectAdmin API, could inject script into the Roundcube interface. Upstream fixed this in the commit “Fix XSS issue in handling of password driver error responses”, which escapes the driver message before display.

Scores

Severity
medium
CVSS v2
4
CVSS v3
4.7
CVSS v4
—
EPSS
—

← All CVEs

Related CVEs

medium

CVE-2026-87937

Drupal Central Authentication System (CAS) Server has an open redirect vulnerability that allows attackers to redirect users to malicious sites. The flaw exists in versions 0.0.0 through 2.0.4 and 2.1.0 through 2.1.3. It can be exploited without authentication, potentially compromising user trust and session integrity.

View analysis

medium

CVE-2026-84919

Drupal PhotoSwipe plugin has a stored XSS flaw that can be triggered by malicious input in image captions or metadata. Attackers can inject scripts that execute in the browser of any user viewing the gallery, potentially leading to session hijacking or defacement.

View analysis

medium

CVE-2026-84924

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Email Verification / SMS Verification / OTP Verification allows Reflected XSS. This issue affects Email Verification / SMS Verification / OTP Verification versions: from 0.0.0 to 2.4.0.

View analysis

medium

CVE-2026-84915

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Component blocks allows Stored XSS. This issue affects Component blocks versions: from 0.0.0 to 1.2.7.

View analysis