Postorius < 1.3.13 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Postorius through 1.3.13 does not escape HTML in the message subject when rendering it in the Held messages pop-up, as exploited in the wild in May 2026.