This vulnerability involves improper neutralization of input during web page generation (CWE-79) in GFI MailEssentials AI. Specifically, the Sender Policy Framework Email Exceptions interface does not properly sanitize the ctl00$ContentPlaceHolder1$pv4$txtEmailDescription parameter, allowing an authenticated user to inject and store malicious HTML/JavaScript. When the stored content is rendered in the management interface, it executes in the context of the logged-in user, enabling cross-site scripting attacks. The issue affects versions prior to 22.4 and requires authentication to exploit.

An authenticated attacker can inject malicious scripts that execute in the context of other logged-in users' browsers when they view the affected interface. This can lead to session hijacking, unauthorized actions within the management interface, or other client-side impacts typical of stored XSS vulnerabilities. The CVSS score of 5.1 reflects a medium severity impact with network attack vector and low complexity.

No official patch or fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected interface to trusted users only and consider monitoring for suspicious activity related to the Sender Policy Framework Email Exceptions interface. Avoid entering untrusted input in the vulnerable parameter.