A stored cross‑site scripting flaw exists in GFI MailEssentials AI versions earlier than 22.4. An authenticated user can supply arbitrary HTML or JavaScript in the POP3 server login field of the JSON popServers payload sent to the POP2Exchange configuration endpoint. The data is persisted and later rendered in the web‑based management interface, enabling the execution of malicious scripts in the context of any logged‑in administrator. This can lead to session hijacking, credential theft, or further lateral movement within the protected network.

GFI Software MailEssentials AI, all releases before 22.4.

The flaw carries a CVSS score of 5.1, indicating moderate severity, and an EPSS score below 1 %. The issue is not listed in the CISA KEV catalog, suggesting no known exploitation yet. The attack requires authentication and only affects the user’s own account at first, but later the malicious script runs in the context of any subsequent administrator who views the configuration. Thus, exploitation is moderately likely only if an attacker has or gains privileged credentials.