The vulnerability exists in GFI MailEssentials AI prior to version 22.4 and allows an authenticated user to inject arbitrary HTML or JavaScript into the ctl00$ContentPlaceHolder1$Pv3$txtDescription field on the Local Domains settings page. The injected content is stored and later rendered in the management interface, which results in the execution of malicious scripts in the browser session of any logged‑in administrator or user. This flaw can be used to steal session cookies, perform phishing, or execute further malicious actions within the context of an authenticated user.

GFI Software MailEssentials AI, versions before 22.4. All pre‑22.4 releases are affected; the exact version range is not specified beyond the pre‑22.4 threshold.

The CVSS base score of 5.1 indicates moderate severity, and the EPSS score of less than 1% implies a very low probability of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires access to the web‑based administration interface and authenticated credentials with permission to edit the Local Domains settings, suggesting a network‑based attack through legitimate user access or credential compromise. No public exploits are documented, but the stored nature of the payload means that once injected, the malicious script will run automatically for any user who views the page in the affected application.