У почтовых клиентов прям чёрная полоса.

CISA adds Roundcube Webmail Persistent XSS bug to its Known Exploited Vulnerabilities catalog

https://securityaffairs.com/159032/hacking/cisa-adds-roundcube-xss-known-exploited-vulnerabilities-catalog.html