The vulnerability exists in the Sender Policy Framework Email Exceptions feature of GFI MailEssentials AI. An authenticated administrator can submit HTML or JavaScript via the ctl00$ContentPlaceHolder1$pv4$txtEmailDescription field to the /MailEssentials/pages/MailSecurity/SenderPolicyFramework.aspx page. The input is stored without sanitization and later rendered in the management interface, enabling script execution within the user’s browser session. This allows an attacker to run arbitrary code, trick users into executing malicious actions, or steal session information.

All installations of GFI MailEssentials AI with a version older than 22.4 are affected, including any deployment that uses the Sender Policy Framework Email Exceptions interface.

The CVSS score of 5.1 indicates moderate impact, and the EPSS score of less than 1% shows a very low probability of exploitation observed at the time of analysis. The flaw is not currently listed in the CISA KEV catalog. Because the vulnerability requires authenticated access, an attacker must first compromise user credentials or infiltrate the administration console. If successful, the stored script persists until the exception entry is edited or deleted, enabling persistent cross‑site scripting for the duration of the legitimate administrator session.