Icegram vulnerabilities

Products

• Email Subscribers \& Newsletters 28
• Engage 10
• Icegram 8
• Email Subscribers & Newsletters 7
• Express 7
• Collect 3
• Engage – Wordpress Lead Generation, Popup Builder, Cta, Optins And Email List Building 2
• Express Pro 2

Newest

• icegram WordPress Icegram plugin <= 3.1.31 - PHP Object Injection vulnerability CVE-2026-97284 8.8 HighOctober 1, 2026
• icegram email subscribers & newsletters Email Subscribers by Icegram Express < 5.9.35 - Unauthenticated Subscription Status Change via Missing Token Verification CVE-2026-83555 5.3 MediumSeptember 23, 2026
• icegram email subscribers & newsletters – email marketing, post notifications & newsletter plugin for wordpress Email Subscribers & Newsletters <= 5.9.27 - Unauthenticated Arbitrary Shortcode Execution via Subscriber Name Field CVE-2026-12757 6.5 MediumSeptember 7, 2026
• icegram email subscribers & newsletters WordPress Email Subscribers & Newsletters plugin <= 5.9.33 - Cross Site Scripting (XSS) vulnerability CVE-2026-81290 7.1 HighAugust 31, 2026
• icegram mailer – reliable email deliverability, no-code smtp replacement & email logs Icegram Mailer <= 1.0.12 - Authenticated (Administrator+) SQL Injection via 'fields' Parameter CVE-2026-15951 4.9 MediumAugust 1, 2026
• icegram engage – popups, optins, ctas & lead generation Icegram Engage <= 3.1.42 - Authenticated (Contributor+) Second-Order SQL Injection via 'messages[][id]' Parameter CVE-2026-16087 6.5 MediumAugust 1, 2026
• icegram email subscribers & newsletters by icegram express – email marketing, post notifications & woocommerce marekting automation for wordpress Email Subscribers & Newsletters <= 5.9.27 - Missing Authorization to Authenticated (Contributor+) Settings Modification via ig_es_handle_request AJAX Action CVE-2026-11592 4.3 MediumJuly 2, 2026
• icegram email subscribers & newsletters – email marketing, post notifications & newsletter plugin for wordpress Email Subscribers & Newsletters <= 5.9.16 - Authenticated (Administrator+) SQL Injection via 'workflow_ids' Parameter CVE-2026-1651 6.5 MediumMarch 4, 2026
• icegram WordPress Icegram plugin <= 3.1.35 - Broken Access Control vulnerability CVE-2025-68507 6.5 MediumJanuary 22, 2026
• icegram express pro WordPress Icegram Express Pro plugin < 5.9.14 - PHP Object Injection vulnerability CVE-2025-68038 7.2 HighDecember 24, 2025
• icegram email subscribers & newsletters – email marketing, post notifications & newsletter plugin for wordpress Email Subscribers & Newsletters <= 5.9.10 - Missing Authentication to Unauthenticated Action Scheduler Task Execution CVE-2025-12348 5.3 MediumDecember 12, 2025
• icegram email subscribers & newsletters WordPress Email Subscribers & Newsletters plugin <= 5.9.10 - PHP Object Injection vulnerability CVE-2025-66055 7.2 HighNovember 21, 2025
• icegram email subscribers & newsletters – email marketing, post notifications & newsletter plugin for wordpress Email Subscribers & Newsletters <= 5.9.10 - Missing Authentication to Unauthenticated Mailing Queue Trigger CVE-2025-12349 5.3 MediumNovember 19, 2025
• icegram express pro WordPress Icegram Express Pro plugin <= 5.9.5 - Server Side Request Forgery (SSRF) vulnerability CVE-2025-49917 4.4 MediumOctober 22, 2025
• icegram collect WordPress Icegram Collect – Easy Form, Lead Collection and Subscription plugin <= 1.3.18 - Broken Access Control Vulnerability CVE-2025-47527 7.1 HighJune 9, 2025
• icegram engage, unknown icegram engage +1 more Icegram Engage < 3.1.32 - Admin+ Stored XSS CVE-2024-13486 4.8 MediumMay 15, 2025
• icegram engage, unknown icegram engage +1 more Icegram Engage < 3.1.32 - Admin+ Stored XSS CVE-2024-13482 4.8 MediumMay 15, 2025
• icegram express, unknown icegram express +1 more Email Subscribers < 5.7.50 - Admin+ Stored XSS in Template CVE-2025-0671 6.1 MediumApril 25, 2025
• icegram express, unknown icegram express formerly known as email subscribers +1 more Email Subscribers < 5.7.52 - Admin+ Stored XSS CVE-2024-11924 3.5 LowApril 17, 2025
• icegram WordPress Icegram Engage plugin <= 3.1.31 - Cross Site Scripting (XSS) vulnerability CVE-2025-24542 6.5 MediumJanuary 24, 2025
• unknown email subscribers by icegram express, icegram email subscribers \& newsletters +1 more Email Subscribers < 5.7.45 - Admin+ Stored XSS CVE-2024-12568 4.8 MediumJanuary 13, 2025
• unknown email subscribers by icegram express, icegram email subscribers \& newsletters +1 more Email Subscribers < 5.7.45 - Admin+ Stored XSS CVE-2024-12567 4.8 MediumJanuary 13, 2025
• unknown email subscribers by icegram express, icegram email subscribers \& newsletters +1 more Email Subscribers < 5.7.45 - Admin+ Stored XSS CVE-2024-12566 4.8 MediumJanuary 13, 2025
• unknown email subscribers by icegram express, icegram email subscribers \& newsletters +1 more Email Subscribers < 5.7.45 - Admin+ Stored XSS CVE-2024-11636 4.8 MediumJanuary 13, 2025
• unknown email subscribers by icegram express, icegram email subscribers \& newsletters +1 more Email Subscribers < 5.7.44 - Admin+ SQL Injection CVE-2024-12311 6.5 MediumJanuary 6, 2025
• icegram engage, unknown icegram engage +1 more Icegram Engage < 3.1.32 - Author+ Stored XSS CVE-2024-12302 6.1 MediumJanuary 6, 2025
• icegram WordPress Icegram Engage plugin <= 3.1.24 - Unauthenticated Message Duplication Vulnerability CVE-2024-39625 5.3 MediumNovember 1, 2024
• icegram collect WordPress Icegram Collect plugin <= 1.3.14 - Broken Access Control vulnerability CVE-2024-43273 5.4 MediumNovember 1, 2024
• icegram email subscribers & newsletters – email marketing, post notifications & newsletter plugin for wordpress, email subscribers \& newsletters +1 more Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce <= 5.7.34 - Authenticated (Subscriber+) Arbitrary Shortcode Execution CVE-2024-8254 5.4 MediumOctober 2, 2024
• icegram email subscribers & newsletters – email marketing, post notifications & newsletter plugin for wordpress, email subscribers \& newsletters +1 more Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce <= 5.7.34 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Expos… CVE-2024-8771 4.3 MediumSeptember 26, 2024
• icegram WordPress Icegram Engage plugin <= 3.1.24 - Unauthenticated Unpublished Campaign Viewer vulnerability CVE-2024-43272 5.3 MediumAugust 19, 2024
• icegram WordPress Icegram Engage – Ultimate WP Popup Builder, Lead Generation, Optins, and CTA plugin <= 3.1.25 - Cross Site Scripting (XSS) vulnerability CVE-2024-43344 6.5 MediumAugust 18, 2024
• icegram email subscribers & newsletters – email marketing, post notifications & newsletter plugin for wordpress, email subscribers \& newsletters +1 more Icegram Express - Email Subscribers, Newsletters and Marketing Automation Plugin <= 5.7.26 - Missing Authorization CVE-2024-5703 4.3 MediumJuly 17, 2024
• icegram email subscribers & newsletters – email marketing, post notifications & newsletter plugin for wordpress, email subscribers \& newsletters +1 more Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce <= 5.7.25 - Unauthenticated SQL Injection via unsubscribe CVE-2024-6172 9.8 CriticalJuly 2, 2024
• icegram email subscribers & newsletters, email subscribers \& newsletters +1 more WordPress Email Subscribers by Icegram Express plugin <= 5.7.25 - SQL Injection vulnerability CVE-2024-37252 9.3 CriticalJune 26, 2024
• icegram express, email subscribers & newsletters – email marketing, post notifications & newsletter plugin for wordpress, email subscribers \& newsletters +2 more Icegram Express - Email Subscribers, Newsletters and Marketing Automation Plugin <= 5.7.23 - Unauthenticated SQL Injection via optin CVE-2024-5756 9.8 CriticalJune 21, 2024
• icegram express, email subscribers & newsletters – email marketing, post notifications & newsletter plugin for wordpress +1 more Icegram Express <= 5.7.22 - Authenticated (Subscriber+) SQL Injection Vulnerability via options[list_id] CVE-2024-4845 8.8 HighJune 12, 2024
• email subscribers & newsletters, icegram email subscribers \& newsletters +1 more WordPress Icegram Express plugin <= 5.7.13 - Broken Access Control vulnerability CVE-2024-31352 5.3 MediumJune 9, 2024
• icegram, icegram express +1 more WordPress Icegram Engage plugin <= 3.1.21 - Broken Access Control vulnerability CVE-2024-21748 4.3 MediumJune 8, 2024
• icegram email subscribers & newsletters – email marketing, post notifications & newsletter plugin for wordpress, email subscribers \& newsletters +1 more Email Subscribers by Icegram Express <= 5.7.20 - Unauthenticated SQL Injection via hash CVE-2024-4295 Public exploit EPSS 10.2% 9.8 CriticalJune 5, 2024
• icegram email subscribers & newsletters – email marketing, post notifications & newsletter plugin for wordpress Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce <= 5.7.17 - Missing Authorization CVE-2024-3626 4.3 MediumMay 23, 2024
• icegram email subscribers & newsletters – email marketing, post notifications & newsletter plugin for wordpress, email subscribers \& newsletters +1 more Email Subscribers by Icegram Express <= 5.7.19 - Missing Authorization in handle_ajax_request CVE-2024-4010 8.8 HighMay 15, 2024
• icegram email subscribers & newsletters – email marketing, post notifications & newsletter plugin for wordpress Icegram Express - Email Subscribers, Newsletters and Marketing Automation Plugin <= 5.7.14 - Unauthenticated SQL Injection CVE-2024-2876 Public exploit EPSS 80.6% 9.8 CriticalMay 2, 2024
• icegram email subscribers & newsletters – email marketing, post notifications & newsletter plugin for wordpress Icegram Express <= 5.7.14 - Authenticated (Administrator+) Cross-Site Scripting via CSV import CVE-2024-2656 4.4 MediumApril 6, 2024
• icegram email subscribers & newsletters WordPress Icegram Express plugin <= 5.7.11 - Reflected Cross Site Scripting (XSS) vulnerability CVE-2024-22300 7.1 HighMarch 27, 2024
• icegram engage – wordpress lead generation, popup builder, cta, optins and email list building, engage +1 more WordPress Icegram Plugin <= 3.1.19 is vulnerable to Cross Site Scripting (XSS) CVE-2023-51532 6.5 MediumFebruary 1, 2024
• icegram engage – wordpress lead generation, popup builder, cta, optins and email list building, engage +1 more WordPress Icegram Plugin <= 3.1.18 is vulnerable to Cross Site Request Forgery (CSRF) CVE-2023-52119 4.3 MediumJanuary 5, 2024
• icegram express – email marketing, newsletters and automation for wordpress & woocommerce, express +1 more WordPress Email Subscribers & Newsletters Plugin <= 5.5.2 is vulnerable to CSV Injection CVE-2022-45810 6.1 MediumNovember 7, 2023
• icegram express, email subscribers & newsletters – email marketing, post notifications & newsletter plugin for wordpress +1 more Icegram Express <= 5.6.23 - Authenticated (Administrator+) Directory Traversal to Arbitrary File Read CVE-2023-5414 9.1 CriticalOctober 20, 2023
• icegram engage, unknown icegram engage +1 more Icegram Engage < 3.1.12 - Reflected XSS CVE-2023-2398 6.1 MediumJune 12, 2023
• Show olderLoading…