What’s Vulnerable › Products

Icegram vulnerabilities

12 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 6 published in the last 12 months.

Check whether your Icegram version is affected

Latest Icegram vulnerabilities

• CVE-2026-97284 — WordPress Icegram plugin <= 3.1.31 - PHP Object Injection vulnerability (CVSS 8.8)
• CVE-2025-15692 — Icegram Express < 5.8.6 - Admin+ Stored XSS (CVSS 3.5)
• CVE-2025-68507 — WordPress Icegram plugin <= 3.1.35 - Broken Access Control vulnerability (CVSS 6.5)
• CVE-2025-0671 — Email Subscribers < 5.7.50 - Admin+ Stored XSS in Template (CVSS 6.1)
• CVE-2024-11924 — Email Subscribers < 5.7.52 - Admin+ Stored XSS (CVSS 3.5)
• CVE-2025-24542 — WordPress Icegram Engage plugin <= 3.1.31 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
• CVE-2024-43344 — WordPress Icegram Engage – Ultimate WP Popup Builder, Lead Generation, Optins, and CTA plugin <= 3.1.25 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
• CVE-2024-5756 — Icegram Express - Email Subscribers, Newsletters and Marketing Automation Plugin <= 5.7.23 - Unauthenticated SQL Injection via optin (CVSS 9.8)
• CVE-2024-4845 — Icegram Express <= 5.7.22 - Authenticated (Subscriber+) SQL Injection Vulnerability via options[list_id] (CVSS 8.8)
• CVE-2024-21748 — WordPress Icegram Engage plugin <= 3.1.21 - Broken Access Control vulnerability (CVSS 5.4)
• CVE-2022-45810 — WordPress Email Subscribers & Newsletters Plugin <= 5.5.2 is vulnerable to CSV Injection (CVSS 9.8)
• CVE-2023-5414 — Icegram Express <= 5.6.23 - Authenticated (Administrator+) Directory Traversal to Arbitrary File Read (CVSS 7.2)