# cve.now: Icegram

The newest entries naming Icegram as an affected vendor (up to 200), of 40 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-97284](https://cve.now/CVE-2026-97284.md): WordPress Icegram plugin \<= 3.1.31 - PHP Object Injection vulnerability (CVSS 8.8)
- [CVE-2026-12757](https://cve.now/CVE-2026-12757.md): Email Subscribers & Newsletters \<= 5.9.27 - Unauthenticated Arbitrary Shortcode Execution via Subscriber Name Field (CVSS 6.5)
- [CVE-2026-81290](https://cve.now/CVE-2026-81290.md): WordPress Email Subscribers & Newsletters plugin \<= 5.9.33 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-15951](https://cve.now/CVE-2026-15951.md): Icegram Mailer \<= 1.0.12 - Authenticated (Administrator+) SQL Injection via 'fields' Parameter (CVSS 4.9)
- [CVE-2026-16087](https://cve.now/CVE-2026-16087.md): Icegram Engage \<= 3.1.42 - Authenticated (Contributor+) Second-Order SQL Injection via 'messages\[\]\[id\]' Parameter (CVSS 6.5)
- [CVE-2026-11592](https://cve.now/CVE-2026-11592.md): Email Subscribers & Newsletters \<= 5.9.27 - Missing Authorization to Authenticated (Contributor+) Settings Modification via ig\_es\_handle\_request AJAX Action (CVSS 4.3)
- [CVE-2026-1651](https://cve.now/CVE-2026-1651.md): Email Subscribers & Newsletters \<= 5.9.16 - Authenticated (Administrator+) SQL Injection via 'workflow\_ids' Parameter (CVSS 6.5)
- [CVE-2025-68507](https://cve.now/CVE-2025-68507.md): WordPress Icegram plugin \<= 3.1.35 - Broken Access Control vulnerability (CVSS 6.5)
- [CVE-2025-68038](https://cve.now/CVE-2025-68038.md): WordPress Icegram Express Pro plugin \< 5.9.14 - PHP Object Injection vulnerability (CVSS 7.2)
- [CVE-2025-12348](https://cve.now/CVE-2025-12348.md): Email Subscribers & Newsletters \<= 5.9.10 - Missing Authentication to Unauthenticated Action Scheduler Task Execution (CVSS 5.3)
- [CVE-2025-66055](https://cve.now/CVE-2025-66055.md): WordPress Email Subscribers & Newsletters plugin \<= 5.9.10 - PHP Object Injection vulnerability (CVSS 7.2)
- [CVE-2025-12349](https://cve.now/CVE-2025-12349.md): Email Subscribers & Newsletters \<= 5.9.10 - Missing Authentication to Unauthenticated Mailing Queue Trigger (CVSS 5.3)
- [CVE-2025-49917](https://cve.now/CVE-2025-49917.md): WordPress Icegram Express Pro plugin \<= 5.9.5 - Server Side Request Forgery (SSRF) vulnerability (CVSS 4.4)
- [CVE-2025-47527](https://cve.now/CVE-2025-47527.md): WordPress Icegram Collect – Easy Form, Lead Collection and Subscription plugin \<= 1.3.18 - Broken Access Control Vulnerability (CVSS 7.1)
- [CVE-2025-24542](https://cve.now/CVE-2025-24542.md): WordPress Icegram Engage plugin \<= 3.1.31 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2024-39625](https://cve.now/CVE-2024-39625.md): WordPress Icegram Engage plugin \<= 3.1.24 - Unauthenticated Message Duplication Vulnerability (CVSS 5.3)
- [CVE-2024-43273](https://cve.now/CVE-2024-43273.md): WordPress Icegram Collect plugin \<= 1.3.14 - Broken Access Control vulnerability (CVSS 5.4)
- [CVE-2024-8254](https://cve.now/CVE-2024-8254.md): Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce \<= 5.7.34 - Authenticated (Subscriber+) Arbitrary Shortcode Execution (CVSS 5.4)
- [CVE-2024-8771](https://cve.now/CVE-2024-8771.md): Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce \<= 5.7.34 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure (CVSS 4.3)
- [CVE-2024-43272](https://cve.now/CVE-2024-43272.md): WordPress Icegram Engage plugin \<= 3.1.24 - Unauthenticated Unpublished Campaign Viewer vulnerability (CVSS 5.3)
- [CVE-2024-43344](https://cve.now/CVE-2024-43344.md): WordPress Icegram Engage – Ultimate WP Popup Builder, Lead Generation, Optins, and CTA plugin \<= 3.1.25 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2024-5703](https://cve.now/CVE-2024-5703.md): Icegram Express - Email Subscribers, Newsletters and Marketing Automation Plugin \<= 5.7.26 - Missing Authorization (CVSS 4.3)
- [CVE-2024-6172](https://cve.now/CVE-2024-6172.md): Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce \<= 5.7.25 - Unauthenticated SQL Injection via unsubscribe (CVSS 9.8)
- [CVE-2024-37252](https://cve.now/CVE-2024-37252.md): WordPress Email Subscribers by Icegram Express plugin \<= 5.7.25 - SQL Injection vulnerability (CVSS 9.3)
- [CVE-2024-5756](https://cve.now/CVE-2024-5756.md): Icegram Express - Email Subscribers, Newsletters and Marketing Automation Plugin \<= 5.7.23 - Unauthenticated SQL Injection via optin (CVSS 9.8)
- [CVE-2024-4845](https://cve.now/CVE-2024-4845.md): Icegram Express \<= 5.7.22 - Authenticated (Subscriber+) SQL Injection Vulnerability via options\[list\_id\] (CVSS 8.8)
- [CVE-2024-21748](https://cve.now/CVE-2024-21748.md): WordPress Icegram Engage plugin \<= 3.1.21 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2024-4295](https://cve.now/CVE-2024-4295.md): Email Subscribers by Icegram Express \<= 5.7.20 - Unauthenticated SQL Injection via hash (CVSS 9.8)
- [CVE-2024-3626](https://cve.now/CVE-2024-3626.md): Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce \<= 5.7.17 - Missing Authorization (CVSS 4.3)
- [CVE-2024-4010](https://cve.now/CVE-2024-4010.md): Email Subscribers by Icegram Express \<= 5.7.19 - Missing Authorization in handle\_ajax\_request (CVSS 8.8)
- [CVE-2024-2876](https://cve.now/CVE-2024-2876.md): Icegram Express - Email Subscribers, Newsletters and Marketing Automation Plugin \<= 5.7.14 - Unauthenticated SQL Injection (CVSS 9.8)
- [CVE-2024-2656](https://cve.now/CVE-2024-2656.md): Icegram Express \<= 5.7.14 - Authenticated (Administrator+) Cross-Site Scripting via CSV import (CVSS 4.4)
- [CVE-2024-22300](https://cve.now/CVE-2024-22300.md): WordPress Icegram Express plugin \<= 5.7.11 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2023-51532](https://cve.now/CVE-2023-51532.md): WordPress Icegram Plugin \<= 3.1.19 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5)
- [CVE-2023-52119](https://cve.now/CVE-2023-52119.md): WordPress Icegram Plugin \<= 3.1.18 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3)
- [CVE-2022-45810](https://cve.now/CVE-2022-45810.md): WordPress Email Subscribers & Newsletters Plugin \<= 5.5.2 is vulnerable to CSV Injection (CVSS 6.1)
- [CVE-2023-5414](https://cve.now/CVE-2023-5414.md): Icegram Express \<= 5.6.23 - Authenticated (Administrator+) Directory Traversal to Arbitrary File Read (CVSS 9.1)
- [CVE-2023-25024](https://cve.now/CVE-2023-25024.md): WordPress Icegram Collect plugin \<= 1.3.8 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9)
- [CVE-2021-36832](https://cve.now/CVE-2021-36832.md): WordPress Icegram plugin \<= 2.0.2 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability (CVSS 4.8)
- [CVE-2018-0602](https://cve.now/CVE-2018-0602.md): Cross-site scripting vulnerability in Email Subscribers & Newsletters versions prior to 3.5.0 allows remote attackers to inject arbitrary we (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/icegram
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.