GFI MailEssentials AI before version 22.4 contains a stored XSS vulnerability (CWE-79) in the Local Domains settings page. An authenticated user can supply malicious HTML/JavaScript in a specific parameter (ctl00$ContentPlaceHolder1$Pv3$txtDescription) on the /MailEssentials/pages/MailSecurity/general.aspx page. This input is stored and later rendered without proper neutralization, enabling script execution within the management interface under the context of the logged-in user. The vulnerability requires authentication and user interaction, and the impact is limited by these factors.

Successful exploitation allows an authenticated user to execute arbitrary scripts in the context of other logged-in users accessing the management interface. This can lead to session hijacking, unauthorized actions within the interface, or other client-side attacks. The CVSS score of 5.1 reflects a medium impact due to the need for authentication and limited scope of the vulnerability.

No official patch or fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the management interface to trusted users only and consider monitoring for unusual activity. Avoid supplying untrusted input in the vulnerable parameter. Follow up with GFI Software for updates or patches addressing this vulnerability.