CVE-2025-30349: Horde Imp

High severity, CVSS 7.2. EPSS: 31.3% chance of exploitation in the next 30 days.

Horde IMP through 6.2.27, as used with Horde Application Framework through 5.2.23, allows XSS that leads to account takeover via a crafted text/html e-mail message with an onerror attribute (that may use base64-encoded JavaScript code), as exploited in the wild in March 2025.

Affected products

• Horde Imp: up to and including 6.2.27

Published 2025-03-21. Last modified 2026-06-17.