CVE-2023-43770

Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability

Exploited in attacks Medium 6.1 Attack chance: 64%

What it is

Roundcube before 1.4.14, 1.5.x before 1.5.4, and 1.6.x before 1.6.3 allows XSS via text/plain e-mail messages with crafted links because of program/lib/Roundcube/rcube_string_replacer.php behavior.

CISA: Roundcube Webmail contains a persistent cross-site scripting (XSS) vulnerability that can lead to information disclosure via malicious link references in plain/text messages.

What to do

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Deadline for US federal agencies: March 4, 2024

Added to the CISA list: February 12, 2024
Published: September 22, 2023
Severity: Medium 6.1 CVSS 3.1
Chance of attacks in the next 30 days (EPSS): 64% in the top 0.8% of all known vulnerabilities
Weakness: CWE-79
More details: NVD · CVE.org · CISA

All references (3)

More exploited flaws from Roundcube

Added	Vulnerability	Product	Severity	Attack chance
Feb 20, 2026	Deserialization of Untrusted DataCVE-2025-49113	Webmail	Critical 9.9	99.7%
Feb 20, 2026	Cross-site ScriptingCVE-2025-68461	Webmail	High 7.2	27%
Jun 9, 2025	Cross-Site ScriptingCVE-2024-42009	Webmail	Critical 9.3	83%
Oct 24, 2024	Cross-Site Scripting (XSS)CVE-2024-37383	Webmail	Medium 6.1	74%
Jun 26, 2024	Cross-Site Scripting (XSS)CVE-2020-13965	Webmail	Medium 6.3	77%
Oct 26, 2023	Persistent Cross-Site Scripting (XSS)CVE-2023-5631	Webmail	Medium 6.1	76%
Jun 22, 2023	Webmail Remote Code ExecutionCVE-2020-12641	Roundcube Webmail	Critical 9.8	84%
Jun 22, 2023	Webmail Cross-Site Scripting (XSS)CVE-2020-35730	Roundcube Webmail	Medium 6.1	33%

All of them →

Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.