The vulnerability is a stored cross‑site scripting flaw in the Sender Policy Framework IP Exceptions interface of GFI MailEssentials AI. An authenticated user can submit malicious HTML or JavaScript via the ctl00$ContentPlaceHolder1$pv2$txtIPDescription parameter, which is saved and subsequently rendered in the management console. When a user later views the page, the stored script runs in the context of that logged‑in session, allowing the attacker to steal credentials, hijack the session, or run arbitrary code within the application’s environment.

GFI Software’s MailEssentials AI product, versions prior to 22.4, is affected. This includes all releases before the 22.4 update, which introduced a fix for the XSS vulnerability in the IP Exceptions description field.

The CVSS score of 5.1 indicates a medium severity, and the EPSS score of less than 1% shows a very low current exploitation probability. Because the flaw requires authenticated access to the IP Exceptions interface, the attack vector is presumed to be an internal or compromised user possessing management privileges; it is not publicly exploitable without credentials. The vulnerability is not listed in the CISA KEV catalog, suggesting no known widespread attacks. Nonetheless, any organization running an affected version should consider the risk significant enough to warrant timely remediation.