Horde and Turbo Contact Manager suffers from multiple cross site scripting vulnerabilities.