GFI MailEssentials AI before version 22.4 contains a stored XSS vulnerability (CWE-79) in the Spam Keyword Checking (Body) conditions interface. An authenticated user can supply malicious HTML/JavaScript in the ctl00$ContentPlaceHolder1$pvGeneral$TXB_Condition parameter to the ASKeywordChecking.aspx page. This input is stored and rendered later in the management interface, enabling script execution within the context of logged-in users. The vulnerability has a CVSS 4.0 base score of 5.1, indicating medium severity. No patch or official fix information is provided in the available data, and the product is not a cloud service.

Successful exploitation allows an authenticated user to execute arbitrary scripts in the context of other logged-in users within the management interface. This could lead to session hijacking, unauthorized actions, or information disclosure within the administrative environment. The impact is limited to authenticated users and the management interface context.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the management interface to trusted users only and consider monitoring for suspicious activity related to the Spam Keyword Checking interface. Avoid inputting untrusted data into the affected parameter.