CVE-2026-54433 is a stored cross-site scripting vulnerability in Roundcube Webmail prior to versions 1.6.17 and 1.7.2. An attacker can craft a plain-text email containing malicious JavaScript that executes automatically when the victim opens or previews the message. This occurs due to improper neutralization of input during web page generation (CWE-79). The vulnerability allows execution of attacker-controlled scripts within the victim's authenticated session, potentially leading to session hijacking or other client-side impacts. No official remediation level or patch links are provided in the available data.

Successful exploitation results in execution of attacker-controlled JavaScript in the context of the victim's authenticated Roundcube Webmail session. This can lead to theft of session tokens, unauthorized actions performed on behalf of the victim, or other client-side attacks. The vulnerability does not require user interaction beyond opening or previewing the malicious email, increasing its risk. There is no indication of known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch links are provided, users should monitor Roundcube's official channels for updates. Until a patch is available, consider disabling automatic email preview features or applying web application firewall rules to detect and block malicious payloads in emails. Avoid opening suspicious emails from untrusted sources.