Icegram Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress

• CVE-2026-12757 Medium 6.5 Email Subscribers & Newsletters <= 5.9.27 - Unauthenticated Arbitrary Shortcode Execution via Subscriber Name Field 0.6%
• CVE-2026-1651 Medium 6.5 Email Subscribers & Newsletters <= 5.9.16 - Authenticated (Administrator+) SQL Injection via 'workflow_ids' Parameter 0.4%
• CVE-2025-12348 Medium 5.3 Email Subscribers & Newsletters <= 5.9.10 - Missing Authentication to Unauthenticated Action Scheduler Task Execution 0.4%
• CVE-2025-12349 Medium 5.3 Email Subscribers & Newsletters <= 5.9.10 - Missing Authentication to Unauthenticated Mailing Queue Trigger 0.3%
• CVE-2024-8254 Medium 5.4 Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce <= 5.7.34 - Authenticated (Subscriber+) Arbitrary Shortcode Execution 0.5%
• CVE-2024-8771 Medium 4.3 Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce <= 5.7.34 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure 0.4%
• CVE-2024-5703 Medium 4.3 Icegram Express - Email Subscribers, Newsletters and Marketing Automation Plugin <= 5.7.26 - Missing Authorization 0.4%
• CVE-2024-6172 Critical 9.8 Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce <= 5.7.25 - Unauthenticated SQL Injection via unsubscribe 1.1%
• CVE-2024-5756 Critical 9.8 Icegram Express - Email Subscribers, Newsletters and Marketing Automation Plugin <= 5.7.23 - Unauthenticated SQL Injection via optin 0.7%
• CVE-2024-4845 High 8.8 Icegram Express <= 5.7.22 - Authenticated (Subscriber+) SQL Injection Vulnerability via options[list_id] 0.5%
• CVE-2024-4295 Critical 9.8 Email Subscribers by Icegram Express <= 5.7.20 - Unauthenticated SQL Injection via hash 10.2%
• CVE-2024-3626 Medium 4.3 Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce <= 5.7.17 - Missing Authorization 0.4%
• CVE-2024-4010 High 8.8 Email Subscribers by Icegram Express <= 5.7.19 - Missing Authorization in handle_ajax_request 0.4%
• CVE-2024-2876 Critical 9.8 Icegram Express - Email Subscribers, Newsletters and Marketing Automation Plugin <= 5.7.14 - Unauthenticated SQL Injection 80.6%
• CVE-2024-2656 Medium 4.4 Icegram Express <= 5.7.14 - Authenticated (Administrator+) Cross-Site Scripting via CSV import 0.3%
• CVE-2023-5414 Critical 9.1 Icegram Express <= 5.6.23 - Authenticated (Administrator+) Directory Traversal to Arbitrary File Read 1.3%