GFI MailEssentials AI versions earlier than 22.4 contain a stored cross‑site scripting flaw in the IP DNS Blocklist configuration page. An authenticated user can provide arbitrary HTML or JavaScript in the ctl00$ContentPlaceHolder1$pv1$TXB_IPs parameter, which is persisted and later displayed in the management interface. This enables the attacker to run scripts with the privileges of the logged‑in user, potentially compromising the user’s session, exfiltrating data, or executing further malicious actions. The impact is confined to the scope of a logged‑in administrator or other privileged user.

The affected product is GFI Software MailEssentials AI. Versions prior to 22.4 are vulnerable; the vulnerability is fixed in version 22.4 and later.

The CVSS score of 5.1 indicates moderate severity, while the EPSS score of less than 1% suggests a low probability of exploitation at the moment. The attacker must first authenticate, limiting the attack to users who have legitimate access to the configuration interface. The vulnerability is not listed in the CISA KEV catalog, so there are no publicly known exploits at this time. The risk remains that a compromised or malicious credential holder could inject and later trigger JavaScript in the management console, potentially impacting the confidentiality, integrity, or availability of the system.