SQL Injection in Icegram Email Subscribers & Newsletters – Marketing, Post Notifications Newsletter Plugin For Wordpress
CVE-2026-1651
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the 'workflow_ids' parameter in all versions up to, and including, 5.9.16 due to insufficient escaping on the user supplied parameter and lack…
Vulnerability class: SQL Injection
EPSS: 0.000 (3.1th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N.
Affected products
Weakness classification (CWE)
References
- www.wordfence.com/threat-intel/vulnerabilities/id/d8dc995d-912e-4d83-84cc-c9924…
- downloads.wordpress.org/plugin/email-subscribers.5.9.15.zip
- plugins.trac.wordpress.org/browser/email-subscribers/trunk/lite/includes/workfl…
- plugins.trac.wordpress.org/browser/email-subscribers/tags/5.9.15/lite/includes/…
- gist.github.com/stevenyu113228/6c5c3f660e6dc739768842c051028f40
- plugins.trac.wordpress.org/changeset/3464881/
Frequently asked questions
- What is CVE-2026-1651?
- CVE-2026-1651 is a medium-severity vulnerability in Icegram Email Subscribers & Newsletters – Marketing, Post Notifications Newsletter Plugin For Wordpress, classified under SQL Injection. CVSS score: 6.5/10. Published 2026-03-04.
- How severe is CVE-2026-1651?
- Medium severity. CVSS v3 base score is 6.5 out of 10.