GFI MailEssentials AI before version 22.4 includes a stored cross‑site scripting flaw in the Spam Keyword Checking (Subject) conditions. An authenticated user can embed HTML or JavaScript payloads into the ctl00$ContentPlaceHolder1$pvSubject$TXB_SubjectCondition parameter. When the input is saved, it is later rendered on the management interface, allowing the embedded script to execute in the browser context of any logged‑in administrator. This can lead to compromise of the user’s session, theft of credentials, or further lateral movement within the organization.

All installations of GFI MailEssentials AI older than 22.4 are vulnerable. This includes the core MailEssentials AI product from GFI Software. Specific version details are listed only as "prior to 22.4".

The CVSS score of 5.1 indicates moderate impact. The EPSS score is less than 1 %, showing a low probability that the vulnerability is actively exploited. It is not listed in the CISA KEV catalog. Attackers must have authenticated access to the mail server’s administration console; otherwise the vulnerability cannot be triggered. Successful exploitation would allow arbitrary script execution on the client’s browser when viewing the compromised keyword list.