The Roundcube team has just released a new security upgrade to the Roundcube program (version 1.4.7,) which prevents cross-site scripting (XSS) attacks via HTML messages. We have tested the latest version of our skins and plugins with this newly released version and are happy to report that they're fully compatible. If you're running the latest version of our software, you can safely upgrade to Roundcube 1.4.7.
For a full list of improvements and fixes in the latest version of Roundcube, click here. We encourage you to upgrade your Roundcube as soon as possible to prevent any potential security problems.