GFI MailEssentials AI versions before 22.4 contain a stored XSS vulnerability (CWE-79) in the Spam Keyword Checking (Subject) conditions interface. An authenticated user can supply malicious HTML/JavaScript via the ctl00$ContentPlaceHolder1$pvSubject$TXB_SubjectCondition parameter to the ASKeywordChecking.aspx page. This input is stored and later rendered in the management interface without proper neutralization, allowing script execution within the context of logged-in users. The vulnerability is identified as CVE-2026-23618 with a CVSS 4.0 score of 5.1, indicating medium severity. No patch or official fix information is currently available.

Successful exploitation allows an authenticated user to execute arbitrary scripts in the context of other logged-in users managing the MailEssentials AI interface. This could lead to session hijacking, unauthorized actions, or information disclosure within the management interface. However, exploitation requires authentication and user interaction, limiting the scope and impact. There are no known active exploits reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the management interface to trusted users only and consider monitoring for suspicious activity related to the Spam Keyword Checking interface. Avoid entering untrusted input in the affected parameter. Follow up with GFI Software for updates on patches or official mitigations.