GFI MailEssentials AI before version 22.4 contains a stored XSS vulnerability (CWE-79) in the Advanced Content Filtering rule creation workflow. An authenticated user can supply malicious HTML/JavaScript in the ctl00$ContentPlaceHolder1$pv1$txtRuleName parameter on the advancedfiltering.aspx page. This input is stored and later rendered without proper neutralization, enabling script execution within the management interface for logged-in users. The vulnerability requires authentication and user interaction, and has a medium CVSS score of 5.1.

An authenticated user with access to the Advanced Content Filtering rule creation can inject malicious scripts that execute in the context of other logged-in users. This could lead to unauthorized actions within the management interface or theft of session information. However, the impact is limited by the requirement for authentication and user interaction, and the vulnerability does not allow direct remote code execution or privilege escalation.

No official patch or fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the Advanced Content Filtering functionality to trusted users only and monitor for suspicious activity. Avoid using untrusted input in rule names or other fields that may be rendered in the management interface.