Unrated
In the rcfilters plugin 2.1.6 for Roundcube, XSS exists via the _whatfilter and _messages parameters (in the Filters section of the settings).
CVE-2018-16736
First seen on SecPulse
References
- advisory github.com
- advisory github.com
- report exploit-db.com