Log in Start free

Icegram

Products

ProductCVEsExploitedLatest
Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress16–Sep 7, 2026
Icegram7–Oct 1, 2026
Email Subscribers & Newsletters4–Aug 31, 2026
Icegram Collect3–Jun 9, 2025
Icegram Engage – WordPress Lead Generation, Popup Builder, CTA, Optins and Email List Building2–Feb 1, 2024
Icegram Express Pro2–Dec 24, 2025
Popups, Welcome Bar, Optins and Lead Generation Plugin – Icegram1–Oct 19, 2021
Email Subscribers & Newsletters by Icegram Express – Email Marketing, Post Notifications & WooCommerce Marekting Automation for WordPress1–Jul 2, 2026
Icegram Engage – Popups, Optins, CTAs & Lead Generation1–Aug 1, 2026
Icegram Express – Email Marketing, Newsletters and Automation for WordPress & WooCommerce1–Nov 7, 2023
Icegram Mailer – Reliable Email Deliverability, No-code SMTP Replacement & Email logs1–Aug 1, 2026

Exploited and recent CVEs

  • CVE-2026-97284 High 8.8 WordPress Icegram plugin <= 3.1.31 - PHP Object Injection vulnerability 0.3%
  • CVE-2026-12757 Medium 6.5 Email Subscribers & Newsletters <= 5.9.27 - Unauthenticated Arbitrary Shortcode Execution via Subscriber Name Field 0.6%
  • CVE-2026-81290 High 7.1 WordPress Email Subscribers & Newsletters plugin <= 5.9.33 - Cross Site Scripting (XSS) vulnerability 0.3%
  • CVE-2026-15951 Medium 4.9 Icegram Mailer <= 1.0.12 - Authenticated (Administrator+) SQL Injection via 'fields' Parameter 0.4%
  • CVE-2026-16087 Medium 6.5 Icegram Engage <= 3.1.42 - Authenticated (Contributor+) Second-Order SQL Injection via 'messages[][id]' Parameter 0.5%
  • CVE-2026-11592 Medium 4.3 Email Subscribers & Newsletters <= 5.9.27 - Missing Authorization to Authenticated (Contributor+) Settings Modification via ig_es_handle_request AJAX Action 0.5%
  • CVE-2026-1651 Medium 6.5 Email Subscribers & Newsletters <= 5.9.16 - Authenticated (Administrator+) SQL Injection via 'workflow_ids' Parameter 0.4%
  • CVE-2025-68507 Medium 6.5 WordPress Icegram plugin <= 3.1.35 - Broken Access Control vulnerability 0.3%
  • CVE-2025-68038 High 7.2 WordPress Icegram Express Pro plugin < 5.9.14 - PHP Object Injection vulnerability 0.4%
  • CVE-2025-12348 Medium 5.3 Email Subscribers & Newsletters <= 5.9.10 - Missing Authentication to Unauthenticated Action Scheduler Task Execution 0.4%
  • CVE-2025-66055 High 7.2 WordPress Email Subscribers & Newsletters plugin <= 5.9.10 - PHP Object Injection vulnerability 0.5%
  • CVE-2025-12349 Medium 5.3 Email Subscribers & Newsletters <= 5.9.10 - Missing Authentication to Unauthenticated Mailing Queue Trigger 0.3%
  • CVE-2025-49917 Medium 4.4 WordPress Icegram Express Pro plugin <= 5.9.5 - Server Side Request Forgery (SSRF) vulnerability 0.2%
  • CVE-2025-47527 High 7.1 WordPress Icegram Collect – Easy Form, Lead Collection and Subscription plugin <= 1.3.18 - Broken Access Control Vulnerability 0.4%
  • CVE-2025-24542 Medium 6.5 WordPress Icegram Engage plugin <= 3.1.31 - Cross Site Scripting (XSS) vulnerability 0.3%
  • CVE-2024-39625 Medium 5.3 WordPress Icegram Engage plugin <= 3.1.24 - Unauthenticated Message Duplication Vulnerability 0.4%
  • CVE-2024-43273 Medium 5.4 WordPress Icegram Collect plugin <= 1.3.14 - Broken Access Control vulnerability 0.4%
  • CVE-2024-8254 Medium 5.4 Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce <= 5.7.34 - Authenticated (Subscriber+) Arbitrary Shortcode Execution 0.5%
  • CVE-2024-8771 Medium 4.3 Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce <= 5.7.34 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure 0.4%
  • CVE-2024-43272 Medium 5.3 WordPress Icegram Engage plugin <= 3.1.24 - Unauthenticated Unpublished Campaign Viewer vulnerability 0.4%
  • CVE-2024-43344 Medium 6.5 WordPress Icegram Engage – Ultimate WP Popup Builder, Lead Generation, Optins, and CTA plugin <= 3.1.25 - Cross Site Scripting (XSS) vulnerability 0.3%
  • CVE-2024-5703 Medium 4.3 Icegram Express - Email Subscribers, Newsletters and Marketing Automation Plugin <= 5.7.26 - Missing Authorization 0.4%
  • CVE-2024-6172 Critical 9.8 Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce <= 5.7.25 - Unauthenticated SQL Injection via unsubscribe 1.1%
  • CVE-2024-37252 Critical 9.3 WordPress Email Subscribers by Icegram Express plugin <= 5.7.25 - SQL Injection vulnerability 0.5%
  • CVE-2024-5756 Critical 9.8 Icegram Express - Email Subscribers, Newsletters and Marketing Automation Plugin <= 5.7.23 - Unauthenticated SQL Injection via optin 0.7%
  • CVE-2024-4845 High 8.8 Icegram Express <= 5.7.22 - Authenticated (Subscriber+) SQL Injection Vulnerability via options[list_id] 0.5%
  • CVE-2024-21748 Medium 4.3 WordPress Icegram Engage plugin <= 3.1.21 - Broken Access Control vulnerability 0.3%
  • CVE-2024-4295 Critical 9.8 Email Subscribers by Icegram Express <= 5.7.20 - Unauthenticated SQL Injection via hash 10.2%
  • CVE-2024-3626 Medium 4.3 Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce <= 5.7.17 - Missing Authorization 0.4%
  • CVE-2024-4010 High 8.8 Email Subscribers by Icegram Express <= 5.7.19 - Missing Authorization in handle_ajax_request 0.4%