GFI MailEssentials AI versions earlier than 22.4 contain a stored cross‑site scripting flaw in the IP Blocklist management interface. An authenticated user can embed arbitrary HTML or JavaScript in the IP description field that is persisted and later rendered in the admin console, enabling script execution under the credentials of any logged‑in administrator or user.

The vulnerability impacts GFI Software's MailEssentials AI product for all users with access to the IP Blocklist page, specifically versions prior to 22.4. The affected file is /MailEssentials/pages/MailSecurity/ipblocklist.aspx. Any instance running these versions is potentially exposed.

The CVSS base score of 5.1 indicates moderate risk, while the EPSS score of less than 1% suggests a low probability of exploitation in the wild. The attack requires legitimate authentication to the web interface and the ability to edit IP blocklist descriptions, so it is a credential‑based attack. The vulnerability is not yet catalogued in CISA's KEV list, but it should still be remediated promptly to prevent potential abuse by insiders or compromised credentials.