A stored cross‑site scripting vulnerability exists in the web interface of SonicWall Email Security appliances. The flaw is caused by improper neutralization of user-supplied input during page generation, allowing a remote authenticated attacker with administrator privileges to inject and run arbitrary JavaScript code within their own browser session. This could enable the attacker to modify page content, capture credentials, or perform unauthorized actions while logged in as admin.

The vulnerability affects all SonicWall Email Security models listed in the CPEs, including the ESA5000, ESA5050, ESA7000, ESA7050, and ESA9000. No specific firmware or software version is identified in the advisory, meaning that any current firmware on these devices may be vulnerable.

The CVSS score of 4.8 indicates moderate severity. An EPSS score of less than 1% suggests a low likelihood of widespread exploitation. The flaw is not present in CISA’s Known Exploited Vulnerabilities catalog. Exploitation requires the attacker to be authenticated as an administrator and to access the web interface that generates the stored script. No public exploits or further attack conditions are documented in the CVE data.