Icegram vulnerabilities
40 CVEs and advisories name Icegram as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-97284WordPress Icegram plugin <= 3.1.31 - PHP Object Injection vulnerability
- CVE-2026-12757Email Subscribers & Newsletters <= 5.9.27 - Unauthenticated Arbitrary Shortcode Execution via Subscriber Name Field
- CVE-2026-81290WordPress Email Subscribers & Newsletters plugin <= 5.9.33 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-15951Icegram Mailer <= 1.0.12 - Authenticated (Administrator+) SQL Injection via 'fields' Parameter
- CVE-2026-16087Icegram Engage <= 3.1.42 - Authenticated (Contributor+) Second-Order SQL Injection via 'messages[][id]' Parameter
- CVE-2026-11592Email Subscribers & Newsletters <= 5.9.27 - Missing Authorization to Authenticated (Contributor+) Settings Modification via ig_es_handle_request AJAX Action
- CVE-2026-1651Email Subscribers & Newsletters <= 5.9.16 - Authenticated (Administrator+) SQL Injection via 'workflow_ids' Parameter
- CVE-2025-68507WordPress Icegram plugin <= 3.1.35 - Broken Access Control vulnerability
- CVE-2025-68038WordPress Icegram Express Pro plugin < 5.9.14 - PHP Object Injection vulnerability
- CVE-2025-12348Email Subscribers & Newsletters <= 5.9.10 - Missing Authentication to Unauthenticated Action Scheduler Task Execution
- CVE-2025-66055WordPress Email Subscribers & Newsletters plugin <= 5.9.10 - PHP Object Injection vulnerability
- CVE-2025-12349Email Subscribers & Newsletters <= 5.9.10 - Missing Authentication to Unauthenticated Mailing Queue Trigger
- CVE-2025-49917WordPress Icegram Express Pro plugin <= 5.9.5 - Server Side Request Forgery (SSRF) vulnerability
- CVE-2025-47527WordPress Icegram Collect – Easy Form, Lead Collection and Subscription plugin <= 1.3.18 - Broken Access Control Vulnerability
- CVE-2025-24542WordPress Icegram Engage plugin <= 3.1.31 - Cross Site Scripting (XSS) vulnerability
- CVE-2024-39625WordPress Icegram Engage plugin <= 3.1.24 - Unauthenticated Message Duplication Vulnerability
- CVE-2024-43273WordPress Icegram Collect plugin <= 1.3.14 - Broken Access Control vulnerability
- CVE-2024-8254Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce <= 5.7.34 - Authenticated (Subscriber+) Arbitrary Shortcode Execution
- CVE-2024-8771Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce <= 5.7.34 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure
- CVE-2024-43272WordPress Icegram Engage plugin <= 3.1.24 - Unauthenticated Unpublished Campaign Viewer vulnerability
- CVE-2024-43344WordPress Icegram Engage – Ultimate WP Popup Builder, Lead Generation, Optins, and CTA plugin <= 3.1.25 - Cross Site Scripting (XSS) vulnerability
- CVE-2024-5703Icegram Express - Email Subscribers, Newsletters and Marketing Automation Plugin <= 5.7.26 - Missing Authorization
- CVE-2024-6172Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce <= 5.7.25 - Unauthenticated SQL Injection via unsubscribe
- CVE-2024-37252WordPress Email Subscribers by Icegram Express plugin <= 5.7.25 - SQL Injection vulnerability
- CVE-2024-5756Icegram Express - Email Subscribers, Newsletters and Marketing Automation Plugin <= 5.7.23 - Unauthenticated SQL Injection via optin
- CVE-2024-4845Icegram Express <= 5.7.22 - Authenticated (Subscriber+) SQL Injection Vulnerability via options[list_id]
- CVE-2024-21748WordPress Icegram Engage plugin <= 3.1.21 - Broken Access Control vulnerability
- CVE-2024-4295Email Subscribers by Icegram Express <= 5.7.20 - Unauthenticated SQL Injection via hash
- CVE-2024-3626Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce <= 5.7.17 - Missing Authorization
- CVE-2024-4010Email Subscribers by Icegram Express <= 5.7.19 - Missing Authorization in handle_ajax_request