Icegram
68 CVEs across 15 Icegram products. Browse Icegram vulnerabilities, severities, and proof-of-concept exploits.
Icegram products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-16087 | Medium | 6.5 | 2026-08-01 | The Icegram Engage – Popups, Optins, CTAs & Lead Generation plugin for WordPress is vulnerable to second-order SQL Injection via 'messages[][id]' Parameter in… |
CVE-2026-15951 | Medium | 4.9 | 2026-08-01 | The Icegram Mailer plugin for WordPress is vulnerable to SQL Injection via the 'fields' parameter in versions up to, and including, 1.0.12. This is due to insu… |
CVE-2026-11592 | Medium | 4.3 | 2026-07-02 | The Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress plugin for WordPress is vulnerable to authorization… |
CVE-2026-1651 | Medium | 6.5 | 2026-03-04 | The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the 'workflow_ids' parameter in all versions up to, and includ… |
CVE-2025-68507 | Medium | 6.5 | 2026-01-22 | Missing Authorization vulnerability in Icegram Icegram icegram allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Icegr… |
CVE-2025-68038 | High | 7.2 | 2025-12-24 | Deserialization of Untrusted Data vulnerability in Icegram Icegram Express Pro email-subscribers-premium allows Object Injection.This issue affects Icegram Exp… |
CVE-2025-12348 | Medium | 5.3 | 2025-12-12 | The Icegram Express - Email Subscribers, Newsletters and Marketing Automation Plugin for WordPress is vulnerable to Missing Authorization in versions up to, an… |
CVE-2025-66055 | High | 7.2 | 2025-11-21 | Deserialization of Untrusted Data vulnerability in Icegram Email Subscribers & Newsletters email-subscribers allows Object Injection.This issue affects Email S… |
CVE-2025-12349 | Medium | 5.3 | 2025-11-19 | The Icegram Express - Email Subscribers, Newsletters and Marketing Automation Plugin for WordPress is vulnerable to Authorization in versions up to, and includ… |
CVE-2025-49917 | Medium | 4.4 | 2025-10-22 | Server-Side Request Forgery (SSRF) vulnerability in Icegram Icegram Express Pro email-subscribers-premium allows Server Side Request Forgery.This issue affects… |
CVE-2025-47527 | High | 7.1 | 2025-06-09 | Missing Authorization vulnerability in Icegram Icegram Collect icegram-rainmaker allows Exploiting Incorrectly Configured Access Control Security Levels.This i… |
CVE-2024-13486 | Medium | 4.8 | 2025-05-15 | The Icegram Engage WordPress plugin before 3.1.32 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to p… |
CVE-2024-13482 | Medium | 4.8 | 2025-05-15 | The Icegram Engage WordPress plugin before 3.1.32 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to p… |
CVE-2025-0671 | Medium | 6.1 | 2025-04-25 | The Icegram Express WordPress plugin before 5.7.50 does not sanitise and escape some of its Template settings, which could allow high privilege users such as… |
CVE-2024-11924 | Low | 3.5 | 2025-04-17 | The Icegram Express formerly known as Email Subscribers WordPress plugin before 5.7.52 does not sanitise and escape some of its settings, which could allow hi… |
CVE-2025-24542 | Medium | 6.5 | 2025-01-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Icegram Icegram icegram allows Stored XSS.This issue affe… |
CVE-2024-12568 | Medium | 4.8 | 2025-01-13 | The Email Subscribers by Icegram Express WordPress plugin before 5.7.45 does not sanitise and escape some of its Workflow settings, which could allow high pri… |
CVE-2024-12567 | Medium | 4.8 | 2025-01-13 | The Email Subscribers by Icegram Express WordPress plugin before 5.7.45 does not sanitise and escape some of its form settings, which could allow high privile… |
CVE-2024-12566 | Medium | 4.8 | 2025-01-13 | The Email Subscribers by Icegram Express WordPress plugin before 5.7.45 does not sanitise and escape some of form settings, which could allow high privilege u… |
CVE-2024-11636 | Medium | 4.8 | 2025-01-13 | The Email Subscribers by Icegram Express WordPress plugin before 5.7.45 does not sanitise and escape some of its Text Block options, which could allow high pr… |
CVE-2024-12311 | Medium | 6.5 | 2025-01-06 | The Email Subscribers by Icegram Express WordPress plugin before 5.7.44 does not sanitize and escape a parameter before using it in a SQL statement, allowing… |
CVE-2024-12302 | Medium | 6.1 | 2025-01-06 | The Icegram Engage WordPress plugin before 3.1.32 does not sanitise and escape some of its Campaign settings, which could allow authors and above to perform S… |
CVE-2024-43273 | Medium | 5.4 | 2024-11-01 | Missing Authorization vulnerability in icegram Icegram Collect plugin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affect… |
CVE-2024-39625 | Medium | 5.3 | 2024-11-01 | Missing Authorization vulnerability in icegram Icegram allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Icegram: from n/a thr… |
CVE-2024-8254 | Medium | 5.4 | 2024-10-02 | The Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce plugin for WordPress is vulnerable to arbitrary… |
CVE-2024-8771 | Medium | 4.3 | 2024-09-26 | The Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce plugin for WordPress is vulnerable to unauthori… |
CVE-2024-43272 | Medium | 5.3 | 2024-08-19 | Missing Authentication for Critical Function vulnerability in icegram Icegram allows Accessing Functionality Not Properly Constrained by ACLs.This issue affect… |
CVE-2024-43344 | Medium | 6.5 | 2024-08-18 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Icegram allows Stored XSS.This issue affects Icegr… |
CVE-2024-5703 | Medium | 4.3 | 2024-07-17 | The Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce plugin for WordPress is vulnerable to unauthori… |
CVE-2024-6172 | Critical | 9.8 | 2024-07-02 | The Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce plugin for WordPress is vulnerable to time-base… |
CVE-2024-37252 | Critical | 9.3 | 2024-06-26 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Icegram Email Subscribers & Newsletters allows SQL Inject… |
CVE-2024-5756 | Critical | 9.8 | 2024-06-21 | The Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce plugin for WordPress is vulnerable to time-base… |
CVE-2024-4845 | High | 8.8 | 2024-06-12 | The Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘options[list_id]’ parameter in all versions up to, and including, 5.7.22 due t… |
CVE-2024-31352 | Medium | 5.3 | 2024-06-09 | Missing Authorization vulnerability in Email Subscribers & Newsletters.This issue affects Email Subscribers & Newsletters: from n/a through 5.7.13. |
CVE-2024-21748 | Medium | 4.3 | 2024-06-08 | Missing Authorization vulnerability in Icegram.This issue affects Icegram: from n/a through 3.1.21. |
CVE-2024-4295 | Critical | 9.8 | 2024-06-05 | The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in all versions up to, and including, 5.7… |
CVE-2024-3626 | Medium | 4.3 | 2024-05-23 | The Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce plugin for WordPress is vulnerable to unauthori… |
CVE-2024-4010 | High | 8.8 | 2024-05-15 | The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to unauthorized access of data, modification of data, and loss of data due to a mis… |
CVE-2024-2876 | Critical | 9.8 | 2024-05-02 | The Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce plugin for WordPress is vulnerable to SQL Injec… |
CVE-2024-2656 | Medium | 4.4 | 2024-04-06 | The Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce plugin for WordPress is vulnerable to Stored Cr… |
CVE-2024-22300 | High | 7.1 | 2024-03-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Icegram Email Subscribers & Newsletters allows Reflected… |
CVE-2023-51532 | Medium | 6.5 | 2024-02-01 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Icegram Icegram Engage – WordPress Lead Generation, Popup… |
CVE-2023-52119 | Medium | 4.3 | 2024-01-05 | Cross-Site Request Forgery (CSRF) vulnerability in Icegram Icegram Engage – WordPress Lead Generation, Popup Builder, CTA, Optins and Email List Building.This… |
CVE-2022-45810 | Medium | 4.7 | 2023-11-07 | Improper Neutralization of Formula Elements in a CSV File vulnerability in Icegram Icegram Express – Email Marketing, Newsletters and Automation for WordPress… |
CVE-2023-5414 | Critical | 9.1 | 2023-10-20 | The Icegram Express plugin for WordPress is vulnerable to Directory Traversal in versions up to, and including, 5.6.23 via the show_es_logs function. This allo… |
CVE-2023-2398 | Medium | 6.1 | 2023-06-12 | The Icegram Engage WordPress plugin before 3.1.12 does not escape a parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scri… |
CVE-2023-25024 | Medium | 5.9 | 2023-04-07 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Icegram Icegram Collect plugin <= 1.3.8 versions. |
CVE-2022-3981 | High | 8.8 | 2022-12-12 | The Icegram Express WordPress plugin before 5.5.1 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL inject… |
CVE-2022-1776 | Medium | 5.4 | 2022-06-27 | The Popups, Welcome Bar, Optins and Lead Generation Plugin WordPress plugin before 2.1.8 does not sanitize and escape some campaign parameters, which could all… |
CVE-2022-0439 | High | 8.8 | 2022-03-07 | The Email Subscribers & Newsletters WordPress plugin before 5.3.2 does not correctly escape the `order` and `orderby` parameters to the `ajax_fetch_report_list… |
CVE-2021-24941 | Medium | 6.1 | 2021-12-21 | The Popups, Welcome Bar, Optins and Lead Generation Plugin WordPress plugin before 2.0.5 does not sanitise and escape the message_id parameter of the get_messa… |
CVE-2021-36832 | Medium | 4.8 | 2021-10-19 | WordPress Popups, Welcome Bar, Optins and Lead Generation Plugin – Icegram (versions <= 2.0.2) vulnerable at "Headline" (&message_data[16][headline]) input. |
CVE-2020-5780 | Medium | 5.3 | 2020-09-10 | Missing Authentication for Critical Function in Icegram Email Subscribers & Newsletters Plugin for WordPress prior to version 4.5.6 allows a remote, unauthenti… |
CVE-2020-5768 | Medium | 4.9 | 2020-07-17 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in Icegram Email Subscribers & Newsletters Plugin for WordPress v4.4.8 all… |
CVE-2020-5767 | Medium | 6.5 | 2020-07-17 | Cross-site request forgery in Icegram Email Subscribers & Newsletters Plugin for WordPress v4.4.8 allows a remote attacker to send forged emails by tricking le… |
CVE-2019-20361 | Critical | 9.8 | 2020-01-08 | There was a flaw in the WordPress plugin, Email Subscribers & Newsletters before 4.3.1, that allowed SQL statements to be passed to the database in the hash pa… |
CVE-2019-19985 | Medium | 5.3 | 2019-12-26 | The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed unauthenticated file download with user information disclosure. |
CVE-2019-19984 | Medium | 6.3 | 2019-12-26 | The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed users with edit_post capabilities to manage plugin settings and ema… |
CVE-2019-19982 | Medium | 5.3 | 2019-12-26 | The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed for unauthenticated option creation. In order to exploit this vulne… |
CVE-2019-19981 | Medium | 5.4 | 2019-12-26 | The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed for CSRF to be exploited on all plugin settings. |
CVE-2019-19980 | Medium | 4.3 | 2019-12-26 | The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a privilege bypass flaw that allowed authenticated users (Subscriber or greater access)… |
CVE-2016-10963 | Medium | 6.1 | 2019-09-16 | The icegram plugin before 1.9.19 for WordPress has XSS. |
CVE-2016-10962 | Medium | 6.5 | 2019-09-16 | The icegram plugin before 1.9.19 for WordPress has CSRF via the wp-admin/edit.php option_name parameter. |
CVE-2019-15830 | Medium | 5.4 | 2019-08-30 | The icegram plugin before 1.10.29 for WordPress has ig_cat_list XSS. |
CVE-2019-14364 | Medium | 6.1 | 2019-07-28 | An XSS vulnerability in the "Email Subscribers & Newsletters" plugin 4.1.6 for WordPress allows an attacker to inject malicious JavaScript code through a publi… |
CVE-2019-13569 | Critical | 9.8 | 2019-07-19 | A SQL injection vulnerability exists in the Icegram Email Subscribers & Newsletters plugin through 4.1.7 for WordPress. Successful exploitation of this vulnera… |
CVE-2018-0602 | Medium | 6.1 | 2018-06-26 | Cross-site scripting vulnerability in Email Subscribers & Newsletters versions prior to 3.5.0 allows remote attackers to inject arbitrary web script or HTML vi… |
CVE-2018-6015 | High | 7.5 | 2018-01-26 | An issue was discovered in the "Email Subscribers & Newsletters" plugin before 3.4.8 for WordPress. Sending an HTTP POST request to a URI with /?es=export at t… |