Stored Cross-Site Scripting Vulnerability in GFI MailEssentials AI

CVE-2026-23618

What is CVE-2026-23618?

GFI MailEssentials AI prior to version 22.4 is affected by a stored cross-site scripting vulnerability in the Spam Keyword Checking interface. This weakness allows an authenticated user to inject malicious HTML or JavaScript code through the ctl00$ContentPlaceHolder1$pvSubject$TXB_SubjectCondition parameter. Once stored, the injected script can be executed in the context of a logged-in user when the management interface renders the data, potentially compromising user accounts and exposing sensitive information.

References