The vulnerability is a stored cross‑site scripting flaw in the Mail Monitoring rule creation endpoint. An attacker who can authenticate to the system can supply arbitrary HTML or JavaScript in the "name" field of the JSON payload sent to /MailEssentials/pages/MailSecurity/MailMonitoring.aspx/Save. The malicious content is persisted and later rendered on the management interface, which causes the script to execute within the browser context of any logged‑in user who opens the interface. The weakness is input‑validation failure (CWE‑79).

The flaw affects GFI Software's MailEssentials AI product, specifically all releases before version 22.4. Users running any earlier version of the product are vulnerable. The issue resides in the Mail Monitoring rule creation endpoint of the application.

The CVSS score of 5.1 reflects a moderate severity, and the EPSS score of less than 1% indicates a low probability of current exploitation. The vulnerability is not listed in the CISA KEV catalog. An authenticated user can craft a malicious JSON payload via the /MailEssentials/pages/MailSecurity/MailMonitoring.aspx/Save endpoint. Successful exploitation results in client‑side script execution within the context of any user who views the affected page. No known exploitation evidence suggests limited exploitation potential.