GFI MailEssentials AI versions prior to 22.4 contain a stored cross‑site scripting vulnerability in the URI DNS Blocklist configuration page. An authenticated user can supply arbitrary HTML/JavaScript in the ctl00$ContentPlaceHolder1$pv1$TXB_URIs parameter that is stored and later rendered in the management interface, allowing script execution in the context of a logged‑in user. This flaw enables an attacker to run malicious code in the victim’s browser, potentially hijacking sessions, stealing credentials, or performing client‑side actions that could lead to data exposure or further exploitation.

The affected product is GFI MailEssentials AI from GFI Software. All releases prior to version 22.4 are vulnerable; any installation using those older versions is at risk. No specific patch version is listed beyond the recommendation to upgrade to 22.4 or later.

The vulnerability has a CVSS score of 5.1 with an EPSS of less than 1 %, indicating low to moderate exploitation probability and no current listing in the CISA KEV catalog. Because the attack requires authenticated access, exploitation is limited to users with management privileges; there is no public exploit reported so far. Nonetheless, the stored payload is executed for all viewing users, so a single compromised account can affect a broader active user base, warranting timely mitigation.