A cross-site scripting (XSS) vulnerability exists in the password plugin of Roundcube Webmail versions before 1.6.20 and 1.7.x before 1.7.5. This occurs because error messages from a password driver are included in the user interface without proper HTML escaping, allowing a backend that can influence these messages to inject malicious scripts. The issue has been fixed upstream by escaping the driver messages before display.