The vulnerability is a stored cross-site scripting flaw in GFI MailEssentials AI prior to version 22.4. An authenticated user can inject HTML or JavaScript into the ctl00$ContentPlaceHolder1$pv3$txtDescription field of the Perimeter SMTP Servers configuration page. These payloads are stored and subsequently rendered in the management interface, allowing the attacker to execute arbitrary scripts in the context of the logged‑in user. This flaw is classified as CWE‑79.

The flaw affects all GFI MailEssentials AI installations running a version earlier than 22.4. The affected product is GFI Software's MailEssentials AI, whose management interface includes the /MailEssentials/pages/MailSecurity/PerimeterSMTPServers.aspx page.

The CVSS base score of 5.1 indicates moderate severity, and the EPSS score of less than 1% shows a very low predicted exploitation probability. The vulnerability is not listed in the CISA KEV catalog. It requires authenticated access to the administrative interface and the ability to modify the Perimeter SMTP Server description settings. An attacker who can inject and store malicious scripts can then have those scripts executed in the context of the logged‑in user, which may allow access to or modification of data visible to that user.