diff --git a/CHANGELOG b/CHANGELOG
index 96c4f7871..6d6c43448 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -52,6 +52,7 @@ CHANGELOG Roundcube Webmail
 - Fix bug where Chrome could not upload the same file that was selected before (#5854)
 - Fix duplicate messages on the list after deleting messages on the next to the last page (#5862)
 - Fix bug where messages count was not updated after delete when imap_cache is set (#5872)
+- Fix potential XSS vulnerability with malformed HTML message markup
 - Bring back double-click behavior on the message list which was removed in 1.3.0 (#5823)
 
 RELEASE 1.3.0