CVE-2018-16736: Improper Neutralization of Input During Web Page Generation

In the rcfilters plugin 2.1.6 for Roundcube, XSS exists via the whatfilter and messages parameters in the Filters section of the settings...