GFI MailEssentials AI versions earlier than 22.4 contain a stored cross‑site scripting vulnerability in the Spam Keyword Checking (Body) conditions interface. An authenticated user can submit HTML or JavaScript payloads through the ctl00$ContentPlaceHolder1$pvGeneral$TXB_Condition field on the /MailEssentials/pages/MailSecurity/ASKeywordChecking.aspx page. The supplied payload is stored and later rendered in the management console, allowing the attacker to execute arbitrary JavaScript in the context of any logged‑in user.

This flaw affects all installations of GFI Software MailEssentials AI running a version prior to 22.4, regardless of the underlying operating system or distribution.

The CVSS score of 5.1 indicates medium severity, and the EPSS score of less than 1% suggests a low likelihood of active exploitation. The vulnerability is not included in the CISA KEV catalog. Exploitation requires a legitimate authenticated session with permission to edit spam keyword conditions, limiting the attack surface to users who can modify those settings. The likely attack vector is the web-based management console, which is inferred from the described interface and data submission path.