What’s Vulnerable › Products

icegram Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress vulnerabilities

36 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 10 published in the last 12 months.

Check whether your icegram Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress version is affected

Latest icegram Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress vulnerabilities

• CVE-2026-83555 — Email Subscribers by Icegram Express < 5.9.35 - Unauthenticated Subscription Status Change via Missing Token Verification (CVSS 5.3)
• CVE-2026-12757 — Email Subscribers & Newsletters <= 5.9.27 - Unauthenticated Arbitrary Shortcode Execution via Subscriber Name Field (CVSS 6.5)
• CVE-2026-1651 — Email Subscribers & Newsletters <= 5.9.16 - Authenticated (Administrator+) SQL Injection via 'workflow_ids' Parameter (CVSS 6.5)
• CVE-2025-12348 — Email Subscribers & Newsletters <= 5.9.10 - Missing Authentication to Unauthenticated Action Scheduler Task Execution (CVSS 5.3)
• CVE-2025-12349 — Email Subscribers & Newsletters <= 5.9.10 - Missing Authentication to Unauthenticated Mailing Queue Trigger (CVSS 5.3)
• CVE-2024-12568 — Email Subscribers < 5.7.45 - Admin+ Stored XSS (CVSS 4.8)
• CVE-2024-12567 — Email Subscribers < 5.7.45 - Admin+ Stored XSS (CVSS 4.8)
• CVE-2024-12566 — Email Subscribers < 5.7.45 - Admin+ Stored XSS (CVSS 4.8)
• CVE-2024-11636 — Email Subscribers < 5.7.45 - Admin+ Stored XSS (CVSS 4.8)
• CVE-2024-12311 — Email Subscribers < 5.7.44 - Admin+ SQL Injection (CVSS 6.5)
• CVE-2024-8254 — Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce <= 5.7.34 - Authenticated (Subscriber+) Arbitrary Shortcode Execution (CVSS 6.3)
• CVE-2024-8771 — Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce <= 5.7.34 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure (CVSS 4.3)
• CVE-2024-5703 — Icegram Express - Email Subscribers, Newsletters and Marketing Automation Plugin <= 5.7.26 - Missing Authorization (CVSS 4.3)
• CVE-2024-6172 — Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce <= 5.7.25 - Unauthenticated SQL Injection via unsubscribe (CVSS 9.8)
• CVE-2024-37252 — WordPress Email Subscribers by Icegram Express plugin <= 5.7.25 - SQL Injection vulnerability (CVSS 9.3)
• CVE-2024-31352 — WordPress Icegram Express plugin <= 5.7.13 - Broken Access Control vulnerability (CVSS 9.8)
• CVE-2024-4295 — Email Subscribers by Icegram Express <= 5.7.20 - Unauthenticated SQL Injection via hash (CVSS 9.8)
• CVE-2024-3626 — Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce <= 5.7.17 - Missing Authorization (CVSS 4.3)
• CVE-2024-4010 — Email Subscribers by Icegram Express <= 5.7.19 - Missing Authorization in handle_ajax_request (CVSS 8.8)
• CVE-2024-2876 — Icegram Express - Email Subscribers, Newsletters and Marketing Automation Plugin <= 5.7.14 - Unauthenticated SQL Injection (CVSS 9.8)
• CVE-2024-2656 — Icegram Express <= 5.7.14 - Authenticated (Administrator+) Cross-Site Scripting via CSV import (CVSS 4.4)
• CVE-2022-3981 — Icegram Express < 5.5.1 - Subscriber+ SQLi (CVSS 8.8)
• CVE-2022-0439 — Email Subscribers & Newsletters < 5.3.2 - Subscriber+ Blind SQL injection (CVSS 8.8)
• CVE-2020-5780 — (CVSS 5.3)
• CVE-2020-5768 — (CVSS 4.9)