Stored Cross-Site Scripting Vulnerability in GFI MailEssentials AI

CVE-2026-23607

What is CVE-2026-23607?

GFI MailEssentials AI versions prior to 22.4 are susceptible to a stored cross-site scripting vulnerability within the Anti-Spam Whitelist management interface. This vulnerability allows authenticated users to input HTML or JavaScript code into the ctl00$ContentPlaceHolder1$pv1$txtDescription parameter on the Whitelist management page. The injected script is then stored and executed in the context of a logged-in user, potentially compromising their session or leading to unauthorized actions. It is crucial for users of affected versions to implement patches or upgrades to mitigate the risk.

References