GFI MailEssentials AI versions before 22.4 contain a stored XSS vulnerability (CWE-79) in the IP Blocklist management page. An authenticated user can supply malicious HTML/JavaScript in the ctl00$ContentPlaceHolder1$pv1$txtIPDescription parameter of the /MailEssentials/pages/MailSecurity/ipblocklist.aspx endpoint. This input is stored and later rendered without proper neutralization, allowing script execution in the context of other logged-in users accessing the management interface. The vulnerability has a CVSS 4.0 base score of 5.1, indicating medium severity. No patch or remediation details are currently available from the vendor or advisory sources.

Successful exploitation allows an authenticated user to execute arbitrary scripts in the context of other authenticated users viewing the IP Blocklist management page. This could lead to session hijacking, unauthorized actions within the management interface, or other impacts typical of stored XSS vulnerabilities. However, exploitation requires at least low-privileged authenticated access, and the overall severity is medium.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the IP Blocklist management page to trusted users only and monitor for suspicious activity. Avoid entering untrusted data into the txtIPDescription parameter. Follow up with GFI Software for updates on patches or official mitigations.