This vulnerability is a stored cross‑site scripting flaw in GFI MailEssentials AI’s Anti‑Spam Whitelist interface. An authenticated user can inject arbitrary HTML or JavaScript into the description field, which is then rendered in the management page, and if the script runs it executes in the context of any logged‑in administrator, potentially allowing the attacker to steal session cookies, modify settings, or launch further attacks against the system.

The vulnerability affects GFI Software’s MailEssentials AI product versions earlier than 22.4. Any installation of MailEssentials AI that has not been upgraded to the 22.4 release or later is susceptible.

The CVSS score is 5.1, indicating moderate severity, and the EPSS score is below 1%, suggesting a low probability of exploitation at present. The attacker must first authenticate to the MailEssentials AI administration console and then supply malicious input via the txtDescription parameter on the Whitelist page. Because the flaw is stored and executed within the user session, it can lead to cross‑site scripting and potentially compromise administrative credentials. The vulnerability is not listed in the CISA KEV catalog, further indicating limited known exploitation activity.