CVE-2025-68461

RoundCube Webmail Cross-site Scripting Vulnerability

Exploited in attacks High 7.2 Attack chance: 27%

What it is

Roundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a Cross-Site-Scripting (XSS) vulnerability via the animate tag in an SVG document.

CISA: RoundCube Webmail contains a cross-site scripting vulnerability via the animate tag in an SVG document.

What to do

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Deadline for US federal agencies: March 13, 2026

Added to the CISA list: February 20, 2026
Published: December 18, 2025
Severity: High 7.2 CVSS 3.1
Chance of attacks in the next 30 days (EPSS): 27% in the top 1.9% of all known vulnerabilities
Weakness: CWE-79
More details: NVD · CVE.org · CISA

All references (2)

More exploited flaws from Roundcube

Added	Vulnerability	Product	Severity	Attack chance
Feb 20, 2026	Deserialization of Untrusted DataCVE-2025-49113	Webmail	Critical 9.9	99.7%
Jun 9, 2025	Cross-Site ScriptingCVE-2024-42009	Webmail	Critical 9.3	83%
Oct 24, 2024	Cross-Site Scripting (XSS)CVE-2024-37383	Webmail	Medium 6.1	74%
Jun 26, 2024	Cross-Site Scripting (XSS)CVE-2020-13965	Webmail	Medium 6.3	77%
Feb 12, 2024	Persistent Cross-Site Scripting (XSS)CVE-2023-43770	Webmail	Medium 6.1	64%
Oct 26, 2023	Persistent Cross-Site Scripting (XSS)CVE-2023-5631	Webmail	Medium 6.1	76%
Jun 22, 2023	Webmail Remote Code ExecutionCVE-2020-12641	Roundcube Webmail	Critical 9.8	84%
Jun 22, 2023	Webmail Cross-Site Scripting (XSS)CVE-2020-35730	Roundcube Webmail	Medium 6.1	33%

All of them →

Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.