CVE-2026-23610 is a stored cross-site scripting vulnerability (CWE-79) affecting GFI Software MailEssentials AI versions prior to 22.4. The issue exists in the POP2Exchange configuration endpoint where an authenticated user can supply HTML/JavaScript in the POP3 server login field within the JSON "popServers" payload sent to /MailEssentials/pages/MailSecurity/POP2Exchange.aspx/Save. This input is stored and later rendered in the management interface without proper neutralization, enabling script execution in the context of a logged-in user. The vulnerability requires authentication and user interaction (UI:P) and has low complexity (AC:L).

Successful exploitation allows an authenticated user to execute arbitrary scripts in the context of other logged-in users accessing the management interface. This could lead to unauthorized actions or disclosure of sensitive information within the management interface. The vulnerability does not allow privilege escalation or direct remote code execution but poses a risk to the integrity and confidentiality of the management interface session.

No official patch or remediation is currently available for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is provided, restrict access to the management interface to trusted users only and consider monitoring for suspicious activity related to the POP2Exchange configuration endpoint. Avoid using untrusted input in the POP3 server login field.